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oe This is an interview of Mike Sena conducted by the House Select 


Committee to Investigate the January 6th Attack on the United States Capitol, pursuant to 
House Resolution 503. 

Mr. Sena, could you please state your full name and spell your last name for the 
record. 

Mr. Sena. I'm Mike Sena. Last name is spelled S, as in Sam, e-n-a. 


— I'm going to introduce for the record everyone in the virtual room 


today, beginning with the colleagues on my side. 


We have present senior investigative counsel i There is 
investigative counsel PF | researcher in, and | see now present 
professional staff member Ji. 


And | think, on your end, it's just you, sir, right? 

Mr. Sena. That's correct. 

an Okay. This will be a staff-led interview, and members, of course, 
may choose to also ask questions. If any of them join the call, | will acknowledge their 
presence and let you know when and if they participate or enter. 

My name is a. and | am investigative counsel for the select 
committee. 

Before we begin, I'd like to describe a few ground rules. 

There is an official reporter transcribing the record of this interview. Please wait 
until each question is completed before you begin your response, and we will try to wait 
until your response is complete before we ask our next question. 


The stenographer cannot record nonverbal responses, such as shaking your head, 
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so it is important that you answer each question with an audible, verbal response. 

We ask that you provide complete answers based on your best recollection. _ If 
the question is not clear, please ask for clarification. If you do not know the answer, 
please simply say so. 

| also want to remind you, as we do with all of our witnesses, that it is unlawful to 
deliberately provide false information to Congress, and you will have an opportunity to 


review the transcript once it is prepared. 


Q Let's start with if you could briefly describe your professional experience. 


EXAMINATION 


A Definitely, and thank you for the question. 

My professional role over the last 28 years has been in law enforcement and 
criminal intelligence, started off in vice and narcotics, worked major crimes, worked 
mainly major narcotics operations between Mexico and South America. And then, after 
9/11, was assigned to start new program operations and ultimately leading a lot of those 
operations across the country in a network called the National Network of Fusion 
Centers. 

| also served as not only the president of the National Fusion Center Association, 
but, in my day job, | am the director of the Northern California Regional Intelligence 
Center, one of the 80 fusion centers in the Nation. And|lam also a director for the 
HIDTA program in northern California, Northern California HIDTA, of which the HIDTA 
program has 33 high-intensity drug-trafficking areas that focus Federal, State, local, 
Tribal, territorial resources on narcotics threats. 

Q When did you begin your role as the head of the Northern California 


Regional Intelligence Center? 
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A In 2012. 

Q Andis that where you still currently serve, correct? 

A | do. 

Q When did you become President of the National Fusion Center Association? 

A Approximately 9 years ago. 

Q And you are still serving as President. Is that correct? 

A That's correct. 

Q_ And both of those positions you held on January 6th of 2021. Is that right? 

A __ That's correct. 

Q Can you tell us what fusion centers, like your own, the Northern California 
Regional Intelligence Center, what they do? 

A _ The role of fusion centers after 9/11 was to identify potential threats, you 
know, both physical and virtual in cyber environment, and to basically train Federal, 
State, local, Tribal, territorial public safety personnel, private-sector organizations, our 
critical infrastructure partners, on signs and indicators of potential behaviors that may 
lead to terrorist attack or other criminal threats. 

And the role of the fusion center, once the training is done, is to collect the data 
from those organizations through suspicious activity reporting and coalesce the 
information, validate as best we can, and then get that information to the best lead 
investigative agencies for follow up to -- in an attempt to thwart those threats, identify 
the threats, and mitigate those threats. 

And then, if the mitigation does not work, the role of a fusion center is also, you 
know, to support investigations in post-event, you know, events where we need to 
support those investigators and folks that need criminal intelligence. 


We also produce both tactical and strategic products to educate all of our users, 
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and that includes our law enforcement, public safety, public health, emergency medicine, 
medical professionals, along with our critical infrastructure partners, on what threats they 
may be facing. 

We also serve a role for special event support in many areas, where we are 
looking for threats in real time, often using real-time open-source analysis and 
coordinating with Federal, State, and local law enforcement agencies, to identify those 
threats and give them at least a lead to help them to follow up before a threat, you know, 
elevates to a level of personal harm. 

Q You mentioned the collection of intelligence as well as scouring certain 
open-source resources yourself to pull the primary intelligence that you can get. If 
you're collecting it, where are you receiving it from usually? 

A Normally it's received from our partners, vetted and trained personnel that 
we have given the -- the -- you know, the knowledge on kind of what is suspicious activity. 
We give them the overview of what the threats may be. And then, once they see the 
threat, the goal is to collect it -- and it's collected many ways, either telephonically, or via 
people going online to their various fusion centers -- and then sending a suspicious 
activity report to the fusion center. And that's our primary collection methodology, is 
either the telephone, text, or online reporting methods. 

Q  Andbypartners, who do you mean? Can you just list some of them? 

A Absolutely. _ It's -- our partners are Federal, State, local law enforcement. 
It's our emergency medical professionals. It's, you know, our first responders in the 
field. It's our partners that may be, you know, critical infrastructure, which, in many 
cases, includes social media companies. It includes, you know, our, you know, critical 
infrastructure from utilities -- oil, gas, electricity, water. Also, our cyber partners that 


protect cyber networks. 
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We also reach out to the public health community and our partners in -- the 
medical professionals who may see indicators of, you know, preplanning activity or 
injuries that are unexplained. 

We also reach out to, you know, local schools and -- and try to educate them on, 
you know, the threats that may be posed by individuals that may want to be involved in 
some type of mass-casualty incident, things like that. 

Q_ Asthe head of the fusion center, what is your role as in could you give us 
maybe a job description for your post? 

A Yeah. In my role as the president of the National Fusion Center 
Association, my role is to help it facilitate, coordination, collaboration among the 80 
fusion centers that we have out there and all of our partners. So, from our Federal law 
enforcement executives in the FBI, Department of Homeland Security, our partners that 
manage the criminal intelligence investigative functions within all of our States, our 
National Governors Association and our other major law enforcement associations from 
Major County Sheriffs, Major City Chiefs of Police, our International Association of Chiefs 
of Police, National Sheriffs Association, all of the major groups out there that have a 
stakehold, our International Association of Firefighters, to coordinate with all of them and 
to help facilitate kind of best practices, identify, you know, a strategy for where fusion 
centers should be in the future, and to provide education to our members, which our 
members of the NFCA are each of the 80 centers and their staff. 

We normally facilitate that through annual training conferences, webinars, 
seminars that we provide, subcommittees that we have that provide education, and also 
to look into best practices for information sharing and collaboration. 

Q Can you describe the relationship that fusion centers possess with the 


Department of Homeland Security and, in particular, the Office of Intelligence and 
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Analysis, which I'll henceforth refer to as DHS I&A? 

A DHS I&A by statute has responsibility for the coordination of the fusion 
center network and the collaboration. They're our primary Federal POC. 

So, on a day-to-day basis, in many centers across the country, DHS Office of 
Intelligence and Analysis, |I&A, personnel are assigned in centers. They're not in every 
center right now, but we do have a close working relationship with them on a daily level 
at the fusion center level in many fusion centers across the country. 

At the national level, my closest POC there is and has always been the Under 
Secretary of I&A, the lead person there that is responsible for the organization. And 
that currently is being held by John Cohen, who is the designated official acting in that 
role. And, you know, from a day-to-day perspective, he's the person | probably talk to 
most daily on activities, coordination, collaboration throughout the network and 
throughout I&A. 

And so we have very strong ties with I&A both statutorily and kind of what we 
have done as far as over the last, you know, 20 years of getting personnel integrated into 
fusion centers. 

Q_ That POC, point of contact, was that the -- you mentioned a -- quite a good 
relationship, facilitation of information between the two of you. Was that the case 
with -- on January 6th with the person in that position at that time? 

A At -- the person at that time -- and that was one of the -- one of the things 
we've had a lot of ups and downs as far as personnel in the position. Currently, great 
with John Cohen. He's been one of my long-term friends. But, at the time, we had, | 
believe -- | think everyone was acting at the time of January 6th, and -- and we didn't have 
the greatest communication just because, you know, there was a lot of people in flux at 


the time. 
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Q_ Are there any restrictions, Federal or local, that guide your collection -- the 
fusion center's collection of intelligence like other agencies within the IC, intelligence 
community? 

A There are a lot of -- you know, and | can only speak from the outside of what 
| see from I&A, but there are a lot more restrictions on kind of what I&A can do as a 
title 50 intelligence community member with the collection of data on U.S. persons. 

The role of fusion centers are in the realm of criminal intelligence, and we are 
working at the State and local level as far as our authorities, so each State has various 
authorities that allow them to collect information based on criminal predicates and 
suspicious activity. 

So, in many ways, the fusion centers have kind of a wider breadth of collection 
capability as, you know, the majority of centers are law enforcement or homeland 
security based that allow us to collect information based on indications of some type of 
criminal activity. 

Q Can you tell me about the structure of certain fusion centers where they're 
either housed, maybe even physically, within law enforcement agencies or they partner 
up with law enforcement agencies, some do and some don't? Can you describe that 
sort of -- the wide breadth of structure of fusion centers across the country? 

A Absolutely. So fusion centers are organically built, and they're built on the 
requirements of the local jurisdictions in which they're housed. So, in many areas of the 
country, the National Network of Fusion Centers, each center was built out -- and, at the 
time, we didn't have baseline capabilities. We didn't have the guidelines for fusion 
centers, and many of them were built on the existing State or local criminal intelligence 
units that we had within those law enforcement jurisdictions. 


For example, when | started out, it was with the California Department of Justice, 
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and we actually established a Bureau of Intelligence, and, you know, that Criminal 
Intelligence Bureau that was established post-9/11 was a reiteration of a previous bureau 
that the State had. 

In other areas, we have fusion centers that were built out of newly formed 
homeland security, emergency management agencies, or an agency that had an 
emergency management function. So there are a handful of agencies that were built 
out of emergency management, you know, foundation, and the majority were built out of 
a law enforcement, criminal intelligence foundation. 

Q_ Andcan you tell me your opinion as to whether you think that's a good 
thing, an advantage, or a disadvantage that the wider breadth of collection available to 
fusion centers, because of their partnerships with local law enforcement? 

A | think that's a -- the reason that fusion centers were built, because we have 
the ability to look at all threats and especially the way the law enforcement function 
works within our Nation. 

You know, each organization of the Federal Government has very restrictive roles 
and responsibility as far as what they can investigate. And, as you go down towards the 
local level, they have a much wider breadth of things that they can investigate at the local 
level and more tools and authorities that they can use. 

So | think the capability and capacity for each of the fusion centers kind of 
leverage the State and local authorities, gives them probably a lot more capability to 
identify threats, especially threats that originate at the local level, whereas many of them 
do. 

So, having that capacity and capability, | think, is really advantageous versus our 
Federal agencies, which many times have a lot more restrictions on what they can collect 


and what they can share. 
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Q I'd like to shift now to the events leading up to January 6th. We're going to 
go back in a little bit to more structural issues. I'll hand it off to my colleague, 
a for him to -- at the end of my questioning to sort of zoom out and talk 
more broadly about the institutions we'll be talking about here today. 

So let's start, then, with the first two MAGA marches on November 14th and 
December -- yes -- November 14th and December 12th of 2020. So, as the head of the 
San Francisco fusion center and president of the national association -- and it may be 
nothing at all, but did you come across anything related to those first two events that 
piqued your interest? 

A You know, there were discussions and things that started coming -- and | 
have to go back to kind of, you know, our collection, especially from social media 
companies and the work that we were doing with them. 

Back in 2018, the local San Francisco FBI field office was being inundated with calls 
from social media companies on, you know, threats to life, things that were immediate 
threats that need to be handled, but there wasn't a good triage methodology. 

So we started to work with a number of the social media companies on reporting 
those as suspicious activity reports to the fusion center. So that methodology started to 
grow and expand as those companies now had an outlet to push threats that they were 
seeing -- their top-tier threats. 

So, as we Started getting, you know, closer to, you know, election day and many 
things that were happening in the Capital and across the country, we started getting an 
increasing number of implied threats from social media companies regarding, you know, 
potential criminal activity, regarding people making implied threats about violence. 

And, at a certain point, my staff started to become inundated with threat 


reporting each day to the point where some of my staff were having some serious 
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problems. | mean, all the threats we receive from these companies, the majority are 
very serious threats where people are, you know, discussing going out and murdering 
folks and killing folks and sharing, you know, things online which are horrendous. 

And it got to the point where, back in 2019, our FBI partners started to build up 
the National Threat Operations Center in the hope of, you know, collecting these types of 
threats from social media companies. So, at acertain point, | reached out to the 
companies, and| said: Hey, we are being inundated. We don't have the staff to 
handle this. We would like to switch you over to the FBI's National Threat Operations 
Center to collect the information. 

And then we started to push those threats directly over to the NTOC, and the 
companies started to move those threats over to the NTOC, implied threats, just because 
there were so many coming through. 

And, at that point, we lost visibility on the threats that we had, but | can only tell 
you that we had too many coming in for our personnel to handle without breaking down. 
And that's kind of the things that we saw, were those implied threats of violence, 
and especially as we got closer to the election. 

Q Can you give us -- an exact date is not necessary -- but an approximation of 
when that switch happened? 

A It was probably early November that we started to say, all right, let's start 
moving -- moving these threats over to the NTOC. 

Q Okay. So, then, did you -- would you have any visibility into a shift in the 
intelligence before the infamous December 19th tweet by President Trump, which, for 
the record, was, be there, will be wild, regarding January 6th, and after, or would you not 
have visibility into that dynamic before and after? 


A We didn't have visibility. In fact, my analyst came to me and said, you 
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know what? We've lost visibility since we've moved these threats over to the FBI's 
NTOC, because we were basically out of the loop at that point. 

Q_ Talk to me about -- so these -- before the switch happened and you were 
seeing these threats, were these the threats related to the election in particular and 
related to Washington, D.C., or just the election and across the country? 

A Mainly just the election across the country. So it wasn't specific to 
Washington, D.C., but a lot of angst and a lot of folks that -- that, you know, were 
displeased with the political environment and, you know, many of these, you know, 
threats were on -- some of them were, you know -- or implied threats were on the verge 
of First Amendment protected activities. 

So, you know, our analysts are trained to look at threats based on the context, and 
the social media companies, which they worked with and provided training to, would do 
the same. So these threats were elevated enough that they -- you know, the companies 
believed that somebody should look into it. 

And so that's kind of our context for that, was that, you know, someone should 
look into it, but sometimes, especially with some of these threats, trying to identify the 
location was not as easy. So we'd have a threat that would come through, but not 
necessarily the details on where that person was who was posting it. 

And one of the other issues that we had -- and this is, you know, a long-going issue 
with social media companies, is that they will provide oftentimes implied threats but 
struggle when we do an emergency disclosure request because the implied threat doesn't 
have a location of the threat or timeline of the threat or, you know -- or we don't have 
the perpetrator or poster's information. 

So, without showing some type of timeline of an imminent threat, the companies 


would oftentimes say: Well, hey, we passed the threat to you, but we -- we can't give 
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you anything more. 

Now, we did have some companies that would provide more what they would 
normally provide in emergency disclosure requests, but others basically said: Well, you 
know, this doesn't meet our requirements for emergency disclosure, although they 
reported it to us. 

So it was a little frustrating to us to, you know, tip and lead and not have any 
context or any additional information from the company that may have had that data. 

Q_ And you mentioned that these were potentially on the line between First 
Amendment, you know, aspirational, and, as you mentioned, implied, not specific. 

What about them, given that some of them came across generic, implied, 
potentially First Amendment -- what about them still made them qualitatively or maybe 
the volume different that stood out for you as a warning and made you confident or 
concerned enough that it needed to be passed on? 

A _ As far as the threats that we were getting, it quadrupled. So, when! saw 
that number coming through and the inability of my staff to manage that number of 
threats, we had to make a change. 

And so | was concerned about, you know, the quantity that were coming through 
because, you know, it wasn't as if the companies changed the employees. It was the 
same employees who had been triaging threats for years with us, and all of a sudden, 
they were of the belief that these threats were elevated. 

So, when | saw that, | had a concern that these threats had to be managed 
effectively and efficiently, and we needed help. And the FBI's, you know, National 
Threat Operation Center folks were happy to take that on. 

In fact, you know, earlier in the year, you know, we had four of the major 


companies actually sent a letter to the Deputy Director of the FBI and said: Hey, we 
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want you to help us with this process. We know you want to help with this process, and 
these are the outline of things that we want you to do that the Northern California 
Regional Intelligence Center currently does. 

And they were able to meet all of them except for the feedback loop part, and the 
feedback loop part was providing information back to the companies on -- not giving 
them full details of the information of, you know, the end result, but just letting them 
know if it was an effective tip or lead that came through and that there was a positive 
result for it, both for closure for the company and for them to improve their process for 
evaluating tips and leads and threats. 

Q I'm going to shift to the January 2nd conversation you had with 
Donell Harvin, but, before that, | want to ask if, between when the, you know, switch 
happened in your fusion center in November until January 2nd, whether you reached out 
to anyone else or heard from any other fusion centers about what they were seeing, if 
between that period there is anything of importance or interest regarding the intelligence 
that you can share with the committee? 

A Well, you know, during that time, we were pretty much the primary center 
in the country that was handling the social media threats directly with those companies, 
so | didn't at that time reach out to the other companies to -- or the other, | should say, 
fusion centers to identify if they were seeing similar activity, just because we had -- we 
had the flow coming to us. Andso| did not reach out to that -- reach out to the other 
centers. 

And then, on January 2nd, you know, when Donell called me early in the 
morning -- Donell Harvin, who was the Director at the time of the national or the NTIC, 
the fusion center in Washington, D.C., you know, he kind of gave me an outline of all the 


things that he had concerns about and said that the hair on the back of his neck was 
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standing up, and he was very scared that something very bad was going to happen. And 
he gave me a detail of what he -- his staff were seeing online and the threats he was 
concerned about, and | shared his concern based on what | had been seeing previously. 

Q Okay. Let's gothroughthat. For the record, NTIC being the National 
Capital Region Threat Intelligence Consortium. 

So, before actually | switch over to January 2nd, my last question on that interim, 
you mentioned that your fusion center in San Francisco was sort of the point for -- was 
heavily doing the social media sort of calling. Can you explain why -- what particular 
vantage point your fusion center had that made it sort of the hub? 

A Part of it was because many of the companies are based in Silicon Valley and 
our area. So, having the ability to have in-person coordination, collaboration with the 
companies, our folks providing our triage methodologies of how we evaluate threats, it 
worked out, you know, very nicely between us and the companies. 

And, once we started working with a couple of the companies, word spread, and 
we became the go-to place for many of the companies out there in America. People 
started to -- you know, people in those social media companies oftentimes didn't know 
where to send those leads to or those tips that they were receiving or the information 
that they saw online that was disturbing. 

They had a place to go if it was the exploitation of a child, sexual exploitation of a 
child. They had NCMEC, National Center for Missing and Exploited Children. They had, 
you know, avenues to go forthat. But they didn't really have an avenue to go for, you 
know, these threats that they were seeing online other than oftentimes trying to call -- if 
they could figure out the local jurisdiction, trying to call a local jurisdiction and tell them: 
I'm seeing this threat online, and | need someone to respond. 


And it would take -- and some of these companies told me it would take them 
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4 hours to locate the right agency to respond, and oftentimes when they responded, they 
spent more time trying to explain who they were and why they were calling than, you 
know, getting the message of this is the threat. 

So it became a really good opportunity for the companies and for us -- the 
companies would -- through the SAR process, would send us the threats, and then we 
would locate the jurisdiction where it started at. And our officers, our intelligence 
officers, our law enforcement officers, our criminal intelligence analysts, would be able 
to, you know, reach those jurisdictions and, in many cases, in minutes, be able to -- be 
able to get the problem solved. 

We've had amazing saves of lives where our analyst has reached out to somebody, 
and, within minutes, officers have shown up on site and saved a person's life. 

And, you know, part of that is also us working -- where we couldn't find the 
information, working with our local law enforcement jurisdictions and the fusion centers 
in those areas with the fusion center's databases, which are oftentimes more extensive at 
the local level, to help identify where a person may be or who a person is based on the 
information that we have. And sometimes that information was just a yearbook sitting 
on the back of a shelf that the analyst saw and being able to pull up that image and figure 
out what school that was and get that information to that right fusion center so they 
could identify that person. 

And, time and time again, everything from a child that was planning a mass 
casualty, you know, event, where he was making threats online and, you know, in 
one -- this case, that specific case, West Virginia State Police knocking on the door and 
taking the kid's gun away from them and getting them the mental help that they needed 
before they did something bad. 


So that was kind of the -- you know, how this grew and built out between the 
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companies and what we were doing. It's just we started having so many of these 
companies that started to push the information that it just became too much once we got 
to the point of the election cycle and the implied threats that were coming through. 

Q__ So, on the 2nd, the -- The Washington reported that Donell Harvin, the head 
of the D.C. fusion center, called you before dawn because he was, quote, growing 
desperate, and, quote, Federal law enforcement agencies did not seem to share his sense 
of urgency. 

Did he communicate that frustration with Federal agencies with you on that call? 

A He --he did. His -- his main, you know, angst was that -- and not 
specifically that -- that he wasn't getting the response from Federal agencies, but mainly 
that he was concerned that there were threats out there that were not being collected 
that needed to be collected to help identify if there was a specific threat to the Capitol. 

And, based on what he was telling me, he said: | believe that there are 
people -- lots of people out there talking about bringing weapons to the Capitol, talking 
about general violence. 

And -- you know, and his concern was that, you know, and the reason that the 
network was created was to leverage all the 80 centers in the Nation to help identify 
those threats. So that was kind of what he wanted to be able to do, was to -- to be able 
to leverage all those agencies, which already include the Federal, State, and local partners 
in those regions, and territorial partners, to help collect the data that he felt he needed to 
see if this is a -- you know, a much larger problem than just what he was seeing as a 
potential threat to the Capitol. 

And that's kind of the gist of our conversation. And, ata certain point, | asked 
him, you know, what he would like to do. 


And he of course goes: Well, what do you recommend? 
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And | said: Wewill puta calltogether. | can put that together for you very 
quickly. Our NFCA structure, we have regional co-chairs. |told him: Hey, reach out 
to your regional co-chair so they're in the loop on this for the Northeast. | will start 
immediately putting together a call and setting that up. And | also asked him to invite 
his Federal partners on the call so that way, you know, they could hear the information at 
the same time. 

Q What he shared with you on that phone call, the sort of urgent things or 
concerning things he was seeing -- bringing guns to Washington, D.C., rhetoric of 
violence -- was any of that new to you, or was that in line with what you had previously 
been seeing? 

A _ The weapons and the violence were new to me. We had seen the veiled 
implied threats of violence towards others, not specific discussions of weapons. Andso 
the weapons piece was new information to me. 

Q  And|Ican imagine why, but if you could, just for the record, explain: Why 
did Dr. Harvin decide to call you in particular to assist him with this? 

A And -- well, Donell called me for a number of reasons. You know, we had a 
close working relationship. He had reached out to me when he first became a director 
and actually flew out to San Francisco. Sol kind of give him an overview of, you know, 
what a fusion center is and described kind of the goals and objectives that we have and, 
you know, helped guide him through the process of trying to, you know, build his fusion 
center the best way he could. 

And then, as the president of the National Fusion Center Association, he was 
looking to me for advice on, you know, how to rally the network, and also just my 
experience over the last 28 years of dealing with threat mitigation and dealing with major 


mass-casualty incidents. He was looking to me for those reasons. 
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Q You mentioned that, out of that conversation, you decided to convene a 
phone call between -- among all of the fusion centers around the country. What day 
was that call held? 

A It was on January 4th -- 

Q  --the 4th. And can you describe for us how that call went? What was the 
level of participation by fusion centers across the country, and what were they reporting? 

A We had -- and | invited the 80 fusion centers and asked them to, you know, 
bring on their pertinent partners if they had any that were going to be on, and we had 
under 300 or so participants that joined up of the 80 people that were invited. So we 
had a lot more people show up than | had anticipated as far as people joining the call. 

And the general gist of the conversations, we had the NTIC and Donell's team, 

Dr. Harvin's team provide an overview of what they were seeing, and also describing in 
certain cases States and areas where they were seeing specific -- you know, what they 
believe were implied threats to the Capitol, people talking about weapons and training, 
people talking about coming with weapons and -- to the Capitol to do potential harm. 
And some of these groups that they had mentioned were unknown to some of the 
centers out there. 

So, you know, Dr. Harvin's team was able to provide them with that information. 

They also sent out a request for information on, you know, a litany of threats that 
were potential indicators of threat behaviors and data that they were looking for. So 
that was also sent out to each of the fusion centers after the call, and it was also told to 
them during the call. 

Those centers or other centers around the country, also some of them said that 
they were seeing some, you know, online implied threats that they were concerned 
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type of activity that may have been related to January 6th events that, you know, had 
some level of concern. 

And part of the discussion -- and this was from Donell's perspective -- is that he 
was very concerned about a potential mass-casualty incident event. And so we 
discussed a couple of things. One was we actually had -- a number of years ago, | wrote 
a document on the role of fusion centers during mass-casualty events and major public 
safety events, and so we went over a little bit of -- kind of the priorities within that, our 
communication strategy; if it did become a mass-casualty event, what would we do? 

Dr. Harvin's team set up a space within the Homeland Security Information 
Network, a situational awareness room, that | believe approximately 32 or 33 of the 
fusion centers in the country joined in that room prior to the event so that they could 
share information in real time. And we also had a national situational awareness space 
within the Homeland Security Information Network that is active 24 hours a day, and that 
room was up as well. But the primary communications were within that situational 
awareness room for the January 6th even that was managed by the NTIC. 

Q How did you interpret the sort of heightened level of participation on behalf 
of the fusion centers? Was that just curiosity, or was it because they were seeing things 
that were concerning them that pulled a lot of people into the call? 

A | believe that there were a few centers that were -- that were seeing things 
that they were concerned about, and there was a larger group of people that just wanted 
to help, to understand what the threats people were seeing were, and to be able to 
support our Washington, D.C., fusion center. 

Q_ Those centers who -- that -- those centers that had -- were seeing things 
similar to what Dr. Harvin and his fusion center were seeing, is that typical? Were they 
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country who were going to go travel to D.C.? Was that sort of their vantage point? 

A Actually, you know, especially with open-source intelligence, oftentimes 
you're not sure of where the person is located. So this was just, you know, people 
within the social media environment doing open-source intelligence that were looking for 
threat words, key indicators, things like that, that were coming across information, but 
not specifically knowing what area of the country it is oftentimes. 

There were some that -- that said that there are things in our local area that they 
were seeing, but oftentimes it was just we're seeing things online that do not look good. 

Q_ iI'llask -- | think the answer is no, but did you gain any sort of impression 
from any of the centers reporting on that call, including potentially NTIC, about any sort 
of shift in the volume or rhetoric concerning the January 6th event itself? So, if 
previously it was surrounding the election when the President tweeted "be there, will be 
wild," did you -- were ever made aware of any shift in tone or rhetoric or volume after 
that event was publicized by the President so widely? 

A You know, a lot of the tools that we have don't quantify the volume of the 
threat information, so the answer is no. And, after we had moved the threat 
information over to the National Threat Operations Center, we really lost visibility on, you 
know, that -- especially the volume of threats that social media companies were seeing. 
We did not have that anymore. 

Q Okay. Andso, after January 4th, up until January 6th, was there any other, 
you know, conversations that you had regarding the intelligence leading up to January 6th 
with anyone else? 

A Only Donell. Donell and | were mainly in conversation with each other 
about, you know, what was going on between those two timeframes, and mainly kind of 
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| did send out an email that summarized kind of the overall discussions during the 
call and also our response plan as well as our, you know, our plan that discusses 
protection of privacy, civil rights, and civil liberties, our guidance on that. But Donell 
was my primary person that | was communicating with during that timeframe. 

Q And was there anything developed -- you said a plan either put in place for 
on January 6th or the leading up -- or the 2 days before it, anything that was created in 
that time period? 

A Well, | mean, Dr. Harvin created an operational plan for the event for his 
center. And, at that time, we had discussed things that we had never done before, like, 
you know, emergency manage -- you know, EMAC agreements, emergency management 
agreements between States and trying to enlist other fusion centers to support the 
operations. 

We did -- between January 6th and, you know, inauguration, we had a number of 
issues trying to get personnel that were allowed to support based on grant funding where 
we had centers that said: Hey, I'm trying to get people to provide support, but, due to 
grant restrictions and preauthorization of overtime and the resources, we're being told 
we can't provide the resources right now. And that became an extreme pain point for 
me. But, you know, we did discuss, hey, how can we make this work? 

And Donell, coming from the emergency management background, you know, 
went through the EMAC process and actually did -- you know, later on for inauguration, 
did the request through the EMAC process. But, prior to that, we didn't have any 
process nationwide for typing up fusion center resources for emergency response and 
coordination. And | think that, you know, that was one of the things, | think, stymied us 
a little bit. 
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being a Homeland Security and Emergency Management Agency fusion center and not 
being a designated law enforcement fusion center or with law enforcement authorities. 
That became a major issue for us with the sharing of criminal intelligence information or, 
more specifically, criminal information. 

| know that Donell had contacted me. | had talked to other centers who were 
trying to pass information or figure a way to pass information to Donell, but said they 
could not because their center did not have a Criminal Justice Information Services 
originating agency identification number, CJIS ORI. 

So his agency was, you know, unfortunately being restricted from getting some 
information based on it being criminal information, which still is a -- it has been a 
struggle. Donell and his team worked hard with the mayor's office to try to get some 
resolution on that, but that's something that also affects and impacts a number of centers 
across the country. It's hard to do criminal intelligence when you can't get criminal 
information. 

So Donell and | had many conversations about the struggles of how to overcome 
this to get the information that they felt they needed in near real time. 

Q Did you have any visibility into how DHS I&A was preparing for the event? 
So did you or other fusion centers receive any information or guidance from them as the 
date approached? 

A Along the whole election cycle, DHS had prepared some bulletins, FBI 
general bulletins about potential threats to elections. You know, nothing specific about 
the January 6th event, but we were in communication. And, onthe January 4th call, | 
did see a number of D.C. phone numbers. __|'m not sure if they were FBI or DHS, but | did 
get text messages from, you know, members of DHS and them hopping on the call and 
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Center, you know, to be able to coordinate information at the D.C. Fusion Center. 

And Donell had also -- because one of my major concerns was our coordination 
with the U.S. Capitol Police, Donell told me that he would have analysts at the U.S. Capitol 
Police in their offices to make sure that there was seamless communication with them at 
their location. 

So that made me feel a lot better. Of course, in the back of my mind | was saying 
to myself, if DHS only had full-time personnel at the NTIC, we wouldn't have to have the 
conversation about them having them that day and would be better integrated. 

The other concern that Donell and | had was the coordination with the FBI, 
and -- because of limited participation at the fusion center in D.C. from the FBI. And 
that was something that | was unsure of at the time, and I'm still -- I'm still not sure who 
from the FBI was on the call, because | kind of put that on Donell to make sure that his 
local partners in that field office and the field division there, along with our partners at 
DHS, were on the call. 

Q_ And so that was going to be my second question. You said that you saw 
some D.C. numbers, several of which could have been FBI. So, much like you just broke 
down with DHS |&A, what role, to the extent you had any visibility, of course, did they 
play in the lead-up to January 6th, FBI? 

A You know, up until that time, | was not sure kind of where they were on the 
events leading up to January 6th as far as information sharing, coordination. | later, of 
course, found out that they had done notification to some of the national capital regional, 
you know, fusion centers -- Maryland, Virginia -- and given them some updates or, you 
know, coordinated through their JTTF somehow at least that there was some concerns 
about January 6th. But that information was not widely available, and | had no 
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became more public. 

Q _ Solet's zoom outa bit. The Washington Post reported about the 
purportedly low regard that the FBI holds for fusion centers, derogatorily calling them 
confusion centers, for example. 

Have you encountered this viewpoint, how prevalent would you characterize it 
being, and do you feel that it -- if you have, did it negatively impact the working 
relationship between fusion centers and the FBI in the lead-up to January 6th? 

A In the coordination with the FBI, you know, it -- overall, we've always had, 
you know, the support and good conversations with the leadership of the FBI, whether it 
be the Director, Deputy Director of the Bureau. At the field level, though, each, you 
know, field office of the FBI operates, you know, within their own boundaries and their 
special agents in charge or assistant director, for those that have assistant directors, 
coordinate with their fusion center or fusion centers, because some of them have more 
than one fusion center in their AOR, individualistically. 

Back in 2017, we did work with the Office of Director of National Intelligence, DHS, 
the FBI -- and the FBI to develop an enhanced engagement initiative, which the FBI Office 
of Partner Engagement was heavily involved in. 

Kerry Sleeper's office was -- at the time, he was the Assistant Director for the 
Office of Partner Engagement in the FBI. And Kevin Saupp, from DHS Office of 
Intelligence Analysis, worked hard to develop a project that would enhance that 
engagement between the fusion centers and the field offices. And it covered 10, you 
know, areas of enhancement and 3 tiers of enhancement or 3 tiers of engagement, and 
that was our goal back in 2017, was that we see gaps between the coordination between 
the FBI and the fusion centers. 
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don't understand what a fusion center is or the roles and responsibilities. Many of them 
have the misunderstanding that fusion centers are a component of the Department of 
Homeland Security and that, in actuality, they are, you know, State and local public safety 
operations that have DHS involvement. 

And many fusion centers, including -- in a number of them, | should say, we have 
seamless, you know, coordination for the most part, you know, where we have all our 
fusion centers are embedded in FBI space or FBI personnel are embedded in the fusion 
center, and we have FBI supervisors that work within the fusion center, or an FBI analyst 
or special agents. 

In those areas, it works phenomenally well, and it's all based, unfortunately, 
fusion center to FBI field division, on personalities, on -- you know -- you know, 
interpersonal relationships rather than, you know, codified understandings of how the 
operations are goingtorun. So, in those areas where there isn't the greatest of 
engagement is where we oftentimes see gaps in that coordination capability. 

The fusion center's role is -- and DHS did publish this and post this, because 
oftentimes -- and even Members of Congress don't know the difference between a Joint 
Terrorism Task Force, a fusion center, the High-Intensity Drug- Trafficking Area program, 
the Regional Information Sharing System's programs, and what their roles are. 

So DHS, you know, has posted kind of this is the roles of the JTTF, this is the roles 
of the fusion center. But unfortunately there is no educational program 
between -- within the FBI so that they understand what fusion centers do. And 
sometimes there has been, you know, misunderstandings of who has what role and how 
the integration should work and the collaboration can work. 

So there are centers around the country where that engagement is low. And we, 
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perspective of the fusion centers, where they felt they stood at that level with their FBI 
field office on engagement based on those 10 areas of engagement and 3 tiers of 
engagement. And we have some centers that have, based on their responses, almost no 
engagement, and we have some that have -- are extremely engaged and embedded with 
each other. 

The goal is, how do we get to that point where we have full integration between 
the operations and collaboration? So that is one of the problems we have. The very 
fact that we don't have full-time personnel at our Nation's Capital in their fusion center is 
aproblem. And, undoubtedly, if we had personnel, we would have had a better 
perspective of what was going on from the FBI's side at that local level. 

Q_ And that last part, you mean on January 6th? 

A On January 6th. 

Q Okay. Sothis misunderstanding, misperception about the role of fusion 
centers then leads to some -- a lack of communication between some fusion centers and 
the FBI, in your view, that did contribute, at least partially, to January 6th and the level of 
preparation? 

A In my understanding, in my conversations with Dr. Harvin, | believe it did. 

Q_ And, for the record, | think you used the acronym AOR, which is area of 
responsibility, correct? 

A __ That's correct. 

Q What about the contribution of fusion centers to the threat picture? So, if 
the FBI isn't so much sharing with the fusion centers, what is your view as to 
the -- whether the information or intelligence collected from the fusion centers were, 
one, getting to the FBI, and, two, being treated seriously given some of the breakdown in 
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A From the perspective of the fusion centers, | mean, their role is that 
collection and -- collection, analysis, and ultimate dissemination of it to the agencies that 
have the authority to investigate. Sol believe that, you know, based on the triage and 
capacity that fusion centers have -- and it varies. | mean, we have fusion centers that 
have 200 people in it, and we have some that have four. And so capacity across the 
Nation varies tremendously. 

In my own center with -- you know, our normal staffing is about 85 people in the 
center. We havea very robust capability. In fact, just in -- I'll give you from the 
example of the Northern California Regional Intelligence Center. We have a team that 
all they do is triage threats and work closely with the FBI, and we are in FBI's face to make 
sure that the Joint Terrorism Task Force gets the leads and tips that they need, along with 
all the background information on potential subjects that they're going to go out and do 
an evaluationon. So that's where that symbiotic role works very well. 

We also have local law enforcement officers that work in our office that, if 
something doesn't meet the thresholds of the FBI, they do followup themselves to -- in 
working with local agencies to identify if there is something that could be collected that 
would elevate it to a Federal investigation for the FBI to at least start doing an assessment 
on. And, if it isn't something that the FBI leads -- you know, an investigation that they 
would lead, then they help find an agency that can do the followup and investigation on 
it. Our folks do that triage for them. And that's where it works extremely well. 

And the other component of that was, years ago, we had two separate systems 
for the collection of suspicious activity reporting. We hada shared space system that 
was being developed and where, you know, individual fusion centers had a server that 
actually all their SARs, suspicious activity reports, tips and leads could go into and then be 
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We also had the FBI's eGuardian system, which is their unclassified system that 
they manage their tips, leads, suspicious activity reports within. 

And, at a certain point, the FBI and DHS came to me and said: Hey, we are not 
going to be able to afford both systems, and | was part that decisionmaking process to say 
that we would go away from shared space due to cost, and that we would go to the 
eGuardian system. 

So that's where tips and leads should go from across the country, into that 
eGuardian system, and that eGuardian system, which is another issue that we have 
nationwide is that, in many field offices of the FBI, they have no understanding of what 
eGuardian is. It's their own system, but they don't know what it is. They work within 
the Guardian system, the classified system. But, unless you're on a threat squad that 
triages information with the eGuardian system, they have no visibility. 

And so what our analysts do is a certain percentage -- and it's usually about -- it 
averages about a third of the reports and tips and leads that we get meet the thresholds 
to go into that eGuardian system. That then is assigned to a JTTF task force officer or 
special agent. And then, once it's evaluated to becoming something that needs further 
investigation, it goes into the Guardian system, and then more substantive squads handle 
those Guardian leads. 

But the whole eGuardian network, that whole understanding of what the 
Nationwide Suspicious Activity Reporting Initiative is, isn't especially well-known within 
the FBI. 

Q_ Andso, at the beginning of your answer, that sort of successful facilitation 
and coordination between FBI and your fusion center, it's your understanding that that is 
not the way, at least prior to January 6th, that the D.C. fusion center operated with its FBI 


counterpart. Is that fair? 


24 


25 


31 


A That's what! understand. That's correct. 

Q Let's talk about DHS I&A in the same vein that we were talking about the FBI. 
So, generally, are there problems in coordination between DHS |&A and the fusion 
centers? 

A It all depends on personnel being onsite. If there are full-time personnel 
on site, we have great collaboration. | mean, what's the whole point of a fusion center: 
You bring all your resources in the same place, and they work together. 

And it becomes problematic when we have no personnel on site or a part-time 
person, which means that there is no time -- yeah. There is no one there oftentimes. 

That -- you know, we have lower levels of engagement based on personnel not 
being there because the other part of that is that, you know, each agency brings their 
systems and resources to the center. So, without a DHS person on site, other than the 
Homeland Security Data Network and the Homeland Security Information Network, there 
are a lot of DHS systems that fusion center personnel don't have access to. 

Q_ And how did that come about, do you think? Why are there some fusion 
centers where there is not that level of engagement? And, similarly with the FBI, do you 
feel that, in those fusion centers, was that a -- did that contribute to the preparation for 
January 6th and in creating a sort of complete threat picture? 

A Oh, absolutely. | -- my -- | wholeheartedly believe that if you don't have the 
right personnel on site to have those discussions with, to have access to their tools and 
resources to bring that to the table, things will be missed. And, you know, when you 
look at -- and I'll go back to DHS's Office of Intelligence and Analysis. They were dealing 
with -- and unfortunately -- a number of restrictions on being able to deploy personnel 
due to congressional restrictions, and those restrictions limited their ability to send 
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And it takes time to get trained personnel in the field. So that contributed to 
even those that they could send out, getting people out in the field. We've had huge 
delays. We've had centers that, in some cases, you know, those that, if somebody 
leaves, it's taken 2 years -- 2 to 3 years to get another person in place. And that has 
caused some major problems with our ability to operate and especially see the threat 
picture. 

The other component of that from the threat picture perspective is, you know, 
fusion centers' engagement in the threat prioritization and processes, the TRP process, 
threat review and prioritization process from the FBI, without having fusion center 
personnel sitting with FBI personnel to review the priorities and the threats in their 
specific area of responsibility, fusion centers are left in the dark and unable to collect the 
information that the FBI needs. 

You know, we also, you know, in our planning process for the collection of criminal 
intelligence, we need the ability to know what threats the FBI is seeing in the local 
jurisdictional area. And, without that, there isa gap. And, you know, that's why it's so 
important to have the personnel on site. 

So, lacking that personnel from the FBI resource perspective, some field offices 
say: | can't send people out to the three fusion centers in my area. In other areas, you 
know, there is a misunderstanding of what does a fusion center bring to the table. And 
that is something that we have not had the capacity, at least at -- you know, currently to, 
you know, encourage and bring all of the FBI personnel, at least the special agents in 
charge and assistant directors that are in the field, up to speed on why they need to 
integrate and be part of their fusion center. 

And | tell this to the FBI -- and I've told it repeatedly -- these fusion centers are as 
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[12:00 p.m.] 

Q Have there been any problems stemming from either an underemphasis or a 
reticence to focus on domestic terrorism? 

A Well, back in 2017, my biggest issue was State and local antiterrorism 
training, which provided a key resource for State and local law enforcement to 
understand domestic terrorism. That program through U.S. DOJ went away, and 
funding was reduced. And, back then, | think it was The Kansas City Star interviewed me 
on that report, and | told them it was abysmal. 

We have to look and focus on domestic terrorism. That is oftentimes -- although 
after 9/11 the focus was on international terrorism, the focus has always, in my mind, 
since | have been doing this job, has been on all terrorism threats. Doesn't matter 
whether it is international or domestic; the impact is the same. 

But there have been issues, especially within, you know, the FBI's resources that 
they have allocated to domestic terrorism activities and issues. The big focus has been, 
for a number of years, on international terrorism. More recently, it's, you know, been 
reevaluated to focus resources on domestic issues. 

But there's also, you know, issues even within, you know, Department of 
Homeland Security, where there have been concerns about, you know, domestic 
terrorism or even, you know, domestic right-wing extremism and violent extremism and, 
you know, reporting on that, you know, especially when people are looking at the Title 50 
authorities they have and how does that look, to collect information on U.S. persons. 

But one of the things especially with that SLAT training, that State and local 
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enforcement on domestic threats. And | can't tell you the heartache | have had over the 
years in dealing with grant personnel -- and this is our Federal Emergency Management, 
you know, grants, FEMA grants -- where the focus has been on international terrorism. 
And trying to say we need to do domestic terrorism training hasn't met criteria in the 
past, because they said, well, it has to have an international terrorism nexus. 

That has been extremely problematic for us over the years, you know, because 
without the training, how are we going to collect the information? How are we going to 
get the key indicators of those that may be a threat to our country? Andso those have 
been major issues for us. 

Q_ In your view, did any of these -- did these views at all impact the lead-up or 
preparation for January 6th? 

A You know, as far as domestic terrorism threat from the fusion center 
perspective and the view that, you know, this could be a potential -- in my mind, 
that -- and | always look at things, especially if there's going to be a large gathering of 
people, that it could be a domestic or international terrorist that could take advantage of 
large crowds of people. 

The other component that we talked about on the call was, you know, our role in 
protecting privacy, civil rights, and civil liberties. That's a fundamental core of all fusion 
centers and what we do. You can't be a fusion center if you don't have a privacy, civil 
rights, civil liberties policy and training and accountability. 

And so our major discussion was, you know, that there may be violent actors that 
want to take advantage of the events that are going to happen, to the point where, you 
know, we need to be aware and look for any signs and signals of potential indicators of 
terrorist activity. 
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PM-ISE, which at that time was within the Office of the Director of National Intelligence, 
developed standards for specific activity reporting, functional standards that, you know, 
described these types of activities, but it was focused on international terrorism. But it 
really doesn't matter if you put the international or domestic in; it impacts all the 
coordination with terrorism. 

So | don't believe that, you know, we were hindered specifically, especially on the 
fusion center level, by whether we called it, you know, a potential domestic terrorist 
event or an international terrorist event. | think, from our perspective, we were just 
doing the collection that we needed to do to help the NTIC. 

Q Do you think that it impacted, though, you know, DHS I&A or FBI, how much 
they were, you know, collecting, looking at, sharing, given potentially a lack of focus on 
domestic violent terrorism in the past? 

A | think in a way it did. And only from the perspective that, you know, 
you're dealing with U.S. persons, you're dealing with implied threats in some cases, you're 
dealing with First Amendment-protected activities. So, you know -- and this is from me 
on the outside -- my only belief is that it did impact some of their abilities and the way 
that they operate. 

You know, if we had said this was an international terrorist event or that the 
threat was coming from al-Qaida or ISIS or a designated group, you know, there would've 
been nothing stopping the FBI or DHS from going full-court press. But because of, you 
know, the sensitivities to, you know, some of these folks, it may just be, you know, our 
interpretation of an implied threat. 

And oftentimes we deal with that, where someone may say that they're not going 
to kill somebody; they just say that | wish someone would kill this person. And, you 
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the means, capability, desire to carry out a threat or are they just, you know, talking 
online. 

Q It does not appear that, outside of Capitol Police, any Federal intelligence or 
law enforcement agency produced a written threat assessment for January 6th that was 
meant to be shared widely. 

Was that a problem, in your view? As in, do you think it would've helped if ones 
had been generated by the FBI or DHS |&A, for example? 

A Well -- and, you know, at the time that things -- our January 4th call, there 
was no real time to put a threat assessment together. And things were moving very 
quickly. And, you know, that's why we had the call. 

You know, prior to, | mean, it would've been great to even have a joint threat 
assessment that would've been done by U.S. Capitol Police, the FBI, DHS, and the NTIC. 
And that is not unheard of. We have done joint threat assessments on every major 
sporting event forever, you know, whether it be, the NFL Super Bowl or whether it be, 
you know, a World Cup, whatever it may be, that agencies get together and do a joint 
threat assessment. 

That would at least have probably outlined, you know, some of the things ahead 
of time and probably prepared a working group that is looking at the threats to 
collaborate more closely. And that's the whole point of a joint threat assessment. 

Each agency comes together and brings their piece to the puzzle. And it may just bea 
Lego set with no pieces that match, but at least everyone's coming to the table. 

And | think that would have helped, to have those groups get together, you know, 
to do that type of threat assessment and coordination and then, also, work on the 
collection strategy of, how are we going to collect information on threats and disseminate 


threats? | think all of those things are helpful. And that, as far as | know, | never saw 


24 


25 


37 


Q  Whydo you think none was completed? 

A Ha. lreally couldn't say. | mean, | -- you know, the U.S. capital region is 
an interesting place with lots of jurisdictions and lots of agencies involved and lots of 
personalities. And | couldn't really tell you why that was not done prior to that. 

Q Do any of the purported constraints -- and we've talked about them here 
today -- the First Amendment concerns, surveilling American citizens even in open source, 
navigating the ambiguous line between actionable specific threats and aspirational 
speech -- do any of those constraints, in your mind, reasonably explain, sort of, the lack of 
this written threat assessment or, you know, real coordination among the agencies? 

Or do you think that open-source speech can, even if it doesn't lead to an 
investigation, to a name, to a knocking on the door, to a warrant, can be used 
nonetheless to posture security without affronting those concerns of the First 
Amendment? 

A Oh, absolutely. | ama firm believer that, especially in the protection of 
major events, that the use of open-source intelligence plays a critical role and that, you 
know, through the training of our personnel on privacy, civil rights, and civil liberties and 
the appropriate methods to triage data, to collect data, and to store data, that we can 
balance public safety with the protection of privacy, civil rights, and civil liberties. 

And through another body that | lead, the Criminal Intelligence Coordinating 
Council, as the chair, we did produce a real-time open-source intelligence guide for fusion 
centers and for all public safety agencies that kind of outlines the roles and 
responsibilities and capabilities. 

The other thing that was produced by the Criminal Intelligence Coordinating 
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enforcement, which also outlines what a fusion center should be doing and what are red 
flags for a fusion center as well. 

So both of those documents were distributed after our call on January 4th to our 
fusion centers. And fusion centers are doing that now, and law enforcement agencies 
that we work with are doing that type of work every day to identify threats online and be 
able to follow up on those threats. 

Whether it be a person that is online posting a picture of them with an AK-47, 
saying they're going to kill somebody, or someone that's talking about, you know, implied 
threats or talking about discussing ways to get around security at an event, our personnel 
have seen that and have stopped it. Or whether it's a violent assault, where a person is 
almost, you know, being beaten to death and their life is saved because our analysts are 
seeing that threat online in real-time and getting medical aid to that person that's being 
injured, that's the work that fusion centers are doing every day. 

So | have no doubt that, you know, with that coordinated effort for special event 
support, with a coordinated approach to joint special event threat assessments, and a 
working group of analysts that work together to that event point, it can be successful. 
I've seen it happen time and time again, whether it's been my own experience doing a 
Super Bowl or major public safety events where we've had large mass gatherings of 
people. When we do this well, people don't get hurt. 

Q Given what you and the other fusion centers were seeing, in particular NTIC, 
do you agree or disagree with the statement made by the former Capitol Police chief 
Steven Sund that there was no specific credible threats leading up to January 6th? 

A Well, | agree with him on the point that there were no specific threats, 
nothing that said "| am going to go at the Capitol with a bomb" or "I'm going to charge the 


Capitol with a gun." But! do believe that there was enough, you know, threat 
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information that we were seeing to believe that something was going to happen. 

And Dr. Harvin, | know, during our discussions, he was reaching out to everyone 
he could to prepare for a mass casualty event, just to say that, you know, you know, 
based on what we're seeing, that he was extremely concerned that people would come 
with weapons and other things, you know, that could harm the public. 

Q_ Sois that paradigm, that lens with which we look at intelligence, is that a 
hindrance? So should the volume and tone of nonspecific threats still serve as an 
adequate warning? 

A | believe they can. But! also have to say that just because you have more 
reporting doesn't mean you have a greater threat. 

And an example of that is, years ago | had an attack on an electrical grid facility, 
Metcalf station in our area, where in the middle of the night a person unloaded hundreds 
of rounds of ammunition into the facility. They also cut the fiber-optic 
cables -- someone cut the fiber-optic cables underneath the facility. And that took out 
that electric grid. 

After that, we had an inundation of reporting about suspicious activity around 
electric facilities. Now, that didn't mean that there was more of a threat; it just means 
people were more observant of the threat. So we have to balance out that volume does 
not always equate to an elevated threat. It's the context in which it is in. 

And so | do believe that, you know, based on, you know, multiple-source 
reporting, that those may be indicators, especially if there are folks that are saying that 
they're going to go -- as more and more users online say they're going to go to an event, 
and especially those that are using implied language that they're bringing weapons, which 
was -- people weren't saying, "I'm going to bring a gun." They'd say they'd bring "blank, 


blank." They'd fill it in with whatever they wanted to call their weapon. 
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And so | think that, in those cases, the ability to triage that type of data -- which 
we still lack in our country. We still lack the ability to have that centralized triage of that 
open-source information to not only identify multiple users but also deconflict agencies 
that may be looking at the same person. 

That is something that, one, we have had our partners in the Regional Information 
Sharing System and our other two major deconfliction systems in the country, which all 
have interconnected their systems, but we don't have agencies right now that are using 
the deconfliction tools to the capacity, robust capacity, they should, and we don't have a 
place where everyone is sharing that open-source intelligence and triaging it. So those 
are problematic issues that we have in an inability to understand the volume of threats. 

Q Perfect. 

I'm going to be handing it over in short order to my colleague. 

| want to turn now to January 6th itself. Can you just talk us through your 
morning up until you hear that the Capitol has been breached? 

A Well, | mean, | was actually, unfortunately, feeling comfortable with our 
preparation, our discussions, our sharing of information, the 32, 33 centers that were in 
Donell's space contributing information. 

And then, when the surge happened on the Capitol, Donell and his team -- Dr. 
Harvin's team became inundated. They didn't have the resources they needed on site. 
You know, it was difficult for remote folks who were seeing things and trying to relay 
information to them to have the triage capability that they needed for all of the data that 
was moving. 

We also had a number of centers there were -- and despite the fact that | had said, 
"Hey, please get in this room before the date, or you won't get in the room; they just 
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in the room and the space. We had so much activity that was going on in the space and 
also telephonic calls that Dr. Harvin's team was getting in the work that they were trying 

to do, that he was -- you know, prior to it, he was hopeful that, you know, it wouldn't go 

horribly wrong, although he was terrified that it would. 

And, then, when it did go wrong and the Capitol was breached, he and his team 
were just to the point of, you know, trying to manage just the information flow and the 
coordination in his role as an emergency management person, that coordination with 
other agencies, trying to get help. And he was desperately trying to get support for 
partners. Andit was hard. His tone to me was very frustrated. 

| was trying to also get someone from the NTIC to be able to update the national 
space that we have for situational awareness. And he, at that time, was unable to get a 
person from his team to update the Nation in that space. And that became a problem, 
because the other centers that weren't in his area had no visibility or no ability to 
contribute information to him. And that became a major problem for us. 

So it was heartbreaking to see what was going on, based on everything that we 
said would potentially happen. Luckily, you know, the worst-case scenario of mass 
casualties did not happen. But, you know, try to share information. 

The other major issue that | had was with the Homeland Security Information 
Network, the Adobe Connect system that is used for the situational awareness rooms. | 
was trying to get geospatial information up, which is critical for us to understand where 
things are at, where major threats may be, or where other threats may be, to identify 
those. And|was told that the system was unable to upload the GIS capability; that 
component of it was not working and would probably not be up for another week. So 
we had no ability to map out what was going on to explain that to the rest of the country. 


Q ___ Did you listen to the President -- the former President's speech? 
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A | did not. 

Q 9 Okay. 

Anything else you want to share with us about January 6th as the attack unfolded 
and ultimately as it was quelled and the Members returned to certify the election late 
into the night, any other conversations with Dr. Harvin, or other measures that you 
assisted in putting in place nationally? 

A We planned a call -- and this was, you know, as soon as Dr. Harvin's team 
could be able to talk to people -- to explain what they were seeing. So we did an 
emergency call, which was part of our plan, to bring partners up to speed on what was 
going on and what they were seeing. 

And his deputy director got on the call and gave an overview of what they were 
experiencing, kind of what they were trying to triage, the things that they were trying to 
do in coordination with the U.S. Capitol Police, you know, just to try to, you know, get 
back to a normal environment after, you know, basically the Capitol had been overtaken. 

Q I'd like to shift to moving forward past January 6th and into the current day. 
Has anything changed with regard to the relationship between fusion centers and Federal 
agencies as a result of January 6th? 

A We've actually had a number of conversations between DHS and the FBI 
about especially the coordination with the FBI. My first priority was to say that we have 
to do better and that we have to work together more closely, that we have to use the 
Enhanced Engagement Initiative to develop, you know, a better capacity. 

The other component of that was, you know, working with Congress on, you 
know, developing a strategy within the Department of Homeland Security, not just for the 
Office of Intelligence and Analysis but the Department of Homeland Security as a whole, 


on how they coordinate with fusion centers. So Public Law 116-116 was passed to 


24 


25 


43 


require that they develop that strategy. 

We've also since then had a meeting with the FBI, an intelligence summit, at their 
office, at the Hoover Building, to discuss, how are we going to, you know, move the 
Enhanced Engagement Initiative and many of the information-sharing gaps that we are 
seeing? How are we going to better coordinate that information-sharing? That has 
been a major focus and is now a major focus of the Director of the FBI and the Deputy 
Director of the FBI. 

The other part of this is that DHS has been holding biweekly calls at the -- you 
know, the Under Secretary of I&A has -- Acting Under Secretary of I&A has been holding a 
call with partners, including the FBI, to have briefings with the leadership of the major law 
enforcement associations of America to talk to them about the threats, to talk to them 
about concerns, and talk to them about, you know, vulnerabilities. So that has helped 
us tremendously to improve communication. 

The one thing that even at the intelligence summit we still lack that -- although 
John Cohen, as the acting head of DHS |&A, and Paul Abbate, as the Deputy Director of 
the FBI, are working extremely closely together. | mean, they are talking regularly. I'm 
talking with both of them. So we've improved, kind of, that coordination at the senior 
level of the organization. 

So I've seen, you know, more conversations than I've seen in years and people 
being able to get together. But! still see gaps where DHS and the FBI are not totally in 
lockstep, you know, especially as you go down the chain of command in the FBI, that we 
haven't got everyone on the same page. 

I've also seen some things that have not been good. One example is the role 
that the Program Manager for the Information Sharing Environment. When 
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Administration now. But when he was there, his role was looking at, kind of, how do we 
improve the entire information-sharing environment? Unfortunately, the focus was on 
international terrorism. So any discussion of domestic terrorism was things out of their 
purview, which is problematic. 

And since Kshemendra Paul left that role, that role had been repeatedly, kind of, 
downgraded and downgraded, and, ultimately, | have no idea who has that role and 
responsibility. | have been told that it has been taken up in the White House, but | have 
no idea who it is. 

And so that person is probably one of the key people to making sure that this all 
works, that makes sure that people, you know -- they have no authority to, you know, 
hold people accountable, but they can get people to convene and to have the important 
discussions that we need to have. 

And, oftentimes, over the years, I've seen |'m either having conversation with DHS 
or the FBI or other organizations but not asa group. And the Criminal Intelligence 
Coordinating Council brings people together to have discussions about best practices and 
policies, but there is not a person that holds people accountable. 

But without the PM-ISE role and with their limited authorities that they have 
specific to international terrorism, we need a person, one, in that role in the first place, 
and we need the role expanded to discuss domestic terrorism threats as well, along with 
whatever major threats our Nation may encounter. 

But without that one person -- and that's kind of the problem that we've had 
throughout the history of our country post-9/11, is that we have a lot of organizations 
and agencies, agencies that should be collocated in fusion centers so that at least we have 
seamless communication, but there's no one to hold people accountable to bring those 
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And in the absence of that, | believe that not only did that contribute to the issues 
we had on January 6th, but that will contribute to the next major event that we have, 
whatever that event may be, that someone has to be responsible for it. So seeing that 
PM-ISE role kind of diminish and, in my viewpoint right now, disappear, we have lost, you 
know, over the years, a large capability that we had. 

Now, that doesn't mean that the Director of National Intelligence is not heavily 
supporting our efforts. They have. So one of the things that we have been doing is 
developing regional intelligence coordination plans -- or, regional integration 
coordination plans to, kind of, define throughout six regions of country -- right now we 
have four of those plans, a fifth is in the works, and a sixth will hopefully be done, if not 
this year, next year -- but to really describe how all these agencies should work together 
on a regional basis, and then ultimately develop that into a national perspective. 

The other component of that is that no one is collecting from a national vantage 
point, doing a national threat assessment that incorporates all the data from the fusion 
centers, the High Intensity Drug Trafficking Areas, our Regional Information Sharing 
System partners. We need to have that capability. 

And even at the local level, if we had all of those folks working together in the D.C. 
area, we would've had a better picture of what the threat is and how to prevent that 
threat anywhere in the country. 

So | think that since January 6th we have made some good strides, but we're 
missing some key components of how to make this effective. 

Q_ And you sort of touched on it, but I'll ask: What were the major lessons 
learned that you took away from January 6th? What did you see as the major failures, 
and, also, what worked well? 


A | think, from my perspective, you know, especially on the January 4th call, 
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that, you know -- and we have done this ever since, is that, if we have a call, | reach out 
directly to the FBI and DHS and ask them to at least have someone on the call to share 
their perspective, if possible. And, you know, | think that making sure that someone in 
their leadership takes a key role in that. 

And as | tell them when | ask them, | don't want a talking head. If you don't have 
anything to say, just say your introductions. | mean, not to be rude to anybody, but 
that's what calls often have turned into, is someone will spend 10 minutes talking about 
their organization and how great they are and not talk about the issues. So we try to 
keep the calls to the point. We try to keep them, you know, where we need to. 

And that call was put together fairly hastily. | mean, | did it on Sunday and put 
that out there. But not getting the perspective of the Federal partners, | think, was 
problematic for me and afterwards. Sol think that they've got to come to the table with 
what they have. 

And they have to be able to give things at a tear-line level of what they know. 

And they may say that there's a classified document, or whatever it may be, and this is 
the location of where it's at, or some way of dissemination. But that's a problem, is 
that, you know, if there is information in the FBI systems or in DHS systems that no one 
sees, then how can we, as fusion centers, have our analysts and intelligence officers make 
accurate judgments without the data? 

And that was one the problems | saw afterwards, is that, you know, there was 
data out there that agencies had that would've given us a lot of help in making our 
judgments. Or even knowing, at times, where people were going to land in their State 
to show up at the capitol. That became a major issue in some of our areas, where 
people are rallying together before they moved to the U.S. Capitol. There were, you 
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inundated, not knowing who these people were or what they were doing. 

That could've been a great opportunity for law enforcement personnel at least to 
get a better understanding of the folks that are headed to the Capitol. And even if they 
had weapons or whatever it may be, to be able to have at least that precursor view of 
what was going on. But, in many cases, local authorities, including the fusion centers, 
had no clue that people are getting together at those specific points. 

So | think that having that knowledge and information ahead of time and 
everybody putting everything on the table at the same time could've at least given us a 
better picture of the threat and better prepared people at local resources to deal with 
large groups of people. 

Q So how would you characterize it, given what you've just said? Would you 
characterize the failure as an intelligence failure, in your mind? A failure to 
operationalize the intelligence? Neither? Oras something else altogether? 

A | mean, | see it mainly as a failure to operationalize the information and 
intelligence. 

That's -- one of the other gaps that we had is we used to have a criminal 
intelligence course for executives to actually get them to be better consumers of the 
information. And not only better consumers, but better be able to ask the questions of 
the folks that manage their criminal intelligence. 

And | think that, oftentimes, there's a misunderstanding by the executives of the 
role of what an intelligence or criminal intelligence section does within their organization. 
You know, in those classes -- | used to teach those classes, and we would often tell the 
executive that your criminal intelligence section needs to report directly to you as the 
executive. You need to be aware of what threats are in your community. You need to 
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You also need to understand the restrictions that we have through 28 CFR Part 23 
of, you know, the Federal regulations and the guidance that we have and the standards 
that we have for collection and protection of the privacy, civil rights, and civil liberties. 

We also need to have the ability, from the intelligence perspective -- and | can't 
tell you how many Federal products | have seen where you go through 20 pages and the 
key points are at the end. We have to be able to deliver a product that actually briefs a 
person and gives them those key points up front. You know, the bottom line up front. 

And | think that -- you know, in retrospective, | think that there was a lot of 
indicators out there. There was a lot of information. | mean, true, there was no, you 
know, smoking gun that said this was going to happen at this time. But there was 
enough concern and issues out there that that should've been the -- you know, that 
should've been up front. 

And, you know, within the threat assessment process, like | said, if everyone had 
worked on the joint threat assessment process, those key indicators probably would've 
been expanded greatly. 

And, also, the ability to disseminate those threat assessments, | mean, that's also 
a major concern of folks. Okay, if we send out a specific threat assessment with, you 
know, key indicators and competing hypotheses that, you know -- my belief is that 
analysts should step out ona ledge. That's their role, is to be able to produce a product 
that is forward-leaning. 

And | oftentimes feel that agencies are so concerned that they're going to be so 
forward-leaning that they're going to be ridiculed. And so people pare down products 
to what is safe, what they feel won't get them in trouble. And then they're afraid that 
that product will go out publicly and that they will be ridiculed for being forward-leaning 
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And that's one of my concerns oftentimes, that when we have joint special event 
threat assessments, is it doesn't give the people the facts that they need to make 
decisions. And | think that that's a change, you know, that we need to make asa 
government, that we need to be able to give people the tools and resources to do that, 
both from the executive. 

So | think that the real issue for me has always been that it's not that there wasn't 
enough indicators. | mean, in fact, everyone says that, hell, if they were following on 
social media, they saw enough themselves to be concerned. | think that it's the inability 
to operationalize the information and understand, you know, what should be done. 

People are always afraid that if they put out too many resources that they are, you 
know -- that somehow that is going to stifle First Amendment activities or that it will 
appear that they're heavy-handed. But inthe absence of those resources, people get 
hurt. 

And so | think that balance and understanding and coordination has got to be 
critical. But | think it really lies within the chief executive's role of how to manage that 
information cycle and to bring on the right leadership within their organization to lead 
intelligence. 

And, at that time, | knew the person that had just started in the U.S. Capitol Police 
and had a long history with NYPD, a very sharp person. But | don't know, kind of, what 
the level of the executives was, and, also, not just the U.S. Capitol Police but the other law 
enforcement agency executives within the region, who may or may not have seen any of 
the information, depending on, you know, what their intel sections were producing. 

Q_ And, for the record, that individual who had previously worked for NYPD 
you're referring to is Jack Donohue, correct? 


A That's correct. 
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Q  Myfinal question before | ask my colleagues to step in: What sort of 
recommendations should the select committee make in your space -- or others, if you 
have any opinions -- to help avoid this from happening in the future? 

A First off -- and this is a big ask -- we need a joint program office. A joint 
program office that is not within DOJ, not within DHS. A joint program office that 
focuses on these information-sharing issues, on the criminal intelligence issues. 

We have tons of groups, committees, advisory groups that -- and | sit on all of 
them. That'sthe problem. | sit on all these groups, disparate groups, that each one of 
these organizations have that is responsible for coordination of information-sharing. 
There really should be, like, one group in the country that has that role and responsibility 
and coordinates that effort. You know, I've been a part of them all, and I've led many of 
them, but not everyone's on the same page. 

And without a joint program office to help lead this effort, we will continue to fail. 
We will have monumental failures based on just this interpersonal relations that each 
part of the country and each fusion center, each FBI office, each DHS office, whoever it 
may be, just on a -- you know, on a -- just based on the interpersonal relationships that 
each individual has. That will lead us to failure. \Weneed some capability to codify the 
roles and responsibility of, you know, that PM-ISE-type role and an organization to 
support it that has personnel from each of those agencies. 

The other thing is, we need accountability for how we manage this process. And, 
unfortunately, there are a number of committees that have jurisdiction on each one of 
these entities, and no one has wanted to hold everyone accountable, so -- just for the 
information-sharing and how that should work. 

Also, major issues with access to information. We have, you know, agencies that 
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information. And some of these things involve whether the person's a non-sworn law 
enforcement officer or not, whether they're an analyst, whether they work for a specific 
type of agency. 

If an organization which is, you know, funded by the Federal Government or 
receives funds by the Federal Government can't get the data that they need from the 
Federal Government, we've failed from the beginning, whether that be criminal justice 
information, whether that be information that the Treasury has on suspicious activity 
reporting that they have. You know, there are data sets here that agencies will not 
provide them to certain people in fusion centers or to certain fusion centers, which, you 
know, have a designated role to stop the threat. 

So, without the authority to access the information, to require agencies to provide 
the data that they need to to the organizations that have been created with the help of 
Congress to combat these threats, we're going to be in the blind in pockets of the 
country. 

We also need accountability on how suspicious activity reporting tips and leads 
are managed and triaged in our Nation. Itisahodgepodge. If you call about a threat 
or a tip or lead on something, you have no idea where that tip or lead's going to go or 
how it's going to be triaged or how it's going to be accounted for and how that tip or lead 
will be closed out. Those are things that we have to have the capability to do. 

The other one is technology. We are using now decades-old technology to share 
information. | actually after January 6th got to the point of frustration where we are still 
using in the situational awareness room, the HSIN, Homeland Security Information 
Network room that DHS funds and pays for, but it's in Adobe Connect, which has limited 
functionality. 


So, post-January 6th, | started a Microsoft Teams group with all of the major law 
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enforcement associations in America and their members so that we could communicate 
across all those partners in real-time. The HSIN platform of Adobe Connect can't send 
alerts out to people. So, if something bad is happening, you don't have a way to tell 
people that something is going on. So having it on a mobile platform is critical. So 
that's what we did. 

The other component that we did -- and this was with the support of DHS -- is we 
have a Geospatial Information Systems area, GIS information-sharing area, within the 
HSIN framework that we built that has dashboards. You know, | think | mentioned 
earlier that we had an inability to get a map to show where things were happening during 
January 6th. So this GIS mapping dashboard we have now allows us to look at all the 
threats that people are reporting in near-real-time and see where they're at and see what 
type of threat they are. 

And, most recently, we had a number of school threats, over 200 in a day, that 
were nationwide. Through that national network of fusion centers, we had that full 
picture in hours of where every threat was reported in the country, what type of threat it 
is. 

That's the type of visual dashboard we need for domestic international terrorism 
threats. We need to be able tosee that. The fusion centers should not be the last one 
to know that there's a domestic terrorism investigation going on in their area until the 
indictment comes down. And, you know, that's a major flaw. 

And, unfortunately, some of the things that came to light after our January 6th 
conversations and information-sharing gaps, some of those were major investigations 
that a Federal agency was doing in a State in a threat to an elected official, and the 
elected official didn't know about the threat until the indictment was in the newspaper. 


And those are the things that we need to make sure that we have full visibility on. 
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So we need the technology today, and not 10-year-old technology, to 
communicate. So that infrastructure has to be put in place. 

And then the other component of that is that our partners at DHS I&A have 
struggled for years with, you know, what they're working within in their Title 50 
authorities. | mean, there's always major concerns in Congress on the breadth of 
authorities that DHS I&A has. But without giving them the same level of footing that the 
FBI has at both having the capacity to have a Title 50 capability and a criminal justice or 
law enforcement capability, they're not able to manage all of the information that should 
be available to them to understand the threat. 

And the other component of that is that there has to be a, not only requirement, 
but also a methodology for tracking the engagement between the FBI and the 
Department of Homeland Security. 

And, finally, the other gap is within the Federal Emergency Management Agency 
and the grants programs. We have struggled for years to have the capability to use the 
funds to deal with the threats in real-time. But | have lost funds over the years because 
| have had funds denied -- even for acts of mass casualty attacks where | have had funds 
denied because they said it wasn't submitted in a timely manner. | should've submitted 
the request for the funds before the attack. | have no idea how do that, but those were 
the things that | have been told. 

So we've got to have more flexibility with the grants and the grant programs and 
the prioritization of those grants on the detection of the threats, both from the physical 
perspective and from the cyber perspective, you know, both those that are cyber-enabled 
and those that are actually attacking systems. But fusion centers have to have a better 
capacity to use the money that they need in the way that they need. 


And | give a great example all the time of the way that the High Intensity Drug 
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Trafficking Area program works. Asa person that's a director of a fusion center program 
and a HIDTA program, | see the great disparities on how it is easier, much easier, to use 
the funds to adapt to the threats within the HIDTA framework. 

And then | get over to the Homeland Security grant program side and the Urban 
Air Security Initiative program side and | pound my head on the wall every day. It's the 
most frustrating, you know, lack of coordination and capability, because the grants were 
not designed for the operational activities that fusion centers do. And that's 
problematic. 

Even the Regional Information Sharing System programs that are funded through 
U.S. DOJ Bureau of Justice Assistance grants have much more better capability to adapt to 
the needs of operations to stop the threat. 

So, without those changes from Congress and direction from Congress to improve 
the funding to deal with the threat -- | can't tell you how frustrating it was for the fusion 
center director to try to support the NTIC and be told that he couldn't support that 
person because -- he couldn't bring on the person because they couldn't approve the 
overtime that potentially would be needed. And so he was unable to give them the 
support they needed. And that's just wrong. We need to be able to leverage all the 
resources that Congress has helped provide, the resources and funding and guidance over 
the years, to deal with the threats every day. 

And | have had funding denied. When | talked about that real-time threat 
program that we did with the social media companies for their reporting, that funding 
was denied. You know, trying to save people's lives was not considered something that 
they believed the grant should be used for. Andthat hurt. And asa fusion center that 
is totally funded by Federal funds, that became extremely problematic forme. You 
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So it's something that each fusion center struggles with in some way, in many 
ways. And we've had conversations with the FEMA Grant Program Directorate, but it is 
like pulling teeth. And oftentimes they will fall back on, "Well, this is the way it is, and 
this is the way Congress likes it." And so, if that's the way it is and that's the way 
Congress likes it, | would ask that, if they could do something about that, that that's a 
major need -- the funding, the technology, the accountability for coordination 
enhancement, and the expanded capability of DHS [&A to be on an equal footing with the 
FBI in understanding the threats, and for the FBI to be able to share that information with 
fusion centers. 

And we have -- you know, | said, why can't we, you know, get at least the capacity 
for every fusion center to have access to FBI systems? And we've struggled with that. 
And, as | said, that's the repository for at least all of the domestic terrorism threat 
information and, you know, international threat information that exists, that we know 
about, that's being investigated, and we don't have full visibility on that. 

So those are some of the major points I'd like to ask. 

Q_ Thank you. 


ess Let me ask my blue team colleagues, —— | if there's 


anyone who wants to ask anything? 


honk, 


Thanks, Mike, for being available. And this has been so thoughtful, and we 


QI just -- | might have missed it. | got kicked off because my internet went 


appreciate it. 


down. But! appreciate all the points you made about -- recommendations going 


forward about the need for a joint program office. 
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But without that, whose responsibility is it to coordinate all of the threats? And| 
think you might have mentioned it and | missed it, but | just want to be clear in my head. 

A The answer is no one. 

So that's the problem, is that the investigation of if it's a domestic -- potential 
domestic terrorism or international terrorism threat, the role for investigation is the FBI. 

You know, we did do -- and this was through the coordination with the Criminal 
Intelligence Coordinating Council years ago -- a joint message on the Nationwide 
Suspicious Activity Reporting Initiative of how information should flow. And the 
message to law enforcement -- well, the message to the public is, please contact your 
local law enforcement. Your local law enforcement, please contact your fusion center 
and/or JTTF, which is not specific -- | mean, the fusion centers are that triage point. 

And that's one of the things that, you know, when | first built up the fusion center 
in San Francisco and started doing the coordination, all the tips and leads and threats go 
through the fusion center. That way, we can triage it so that JTTF task force personnel 
aren't running down leads and information that are innocuous but they can't figure out 
heads or tails and wasting time; that they have a -- the goal is, have a full package of what 
the tip/lead/threat may be, and, that way, their role is to investigate. And the role of 
fusion centers is to triage and do the analysis. 

That's not the way it is around the country. So, depending on where you're at, it 
may go to the JTTF, it may go to the fusion center. Hell, it may not go to either 
sometimes. It'samess. So there's no one entity in the country that's responsible for 
the triage and management of the threat information. 

And -- oh, go ahead. 

Q_ So let me just -- let me just understand it. From the fusion center threat 


information that's pushed up to DHS I&A, is it your expectation that, if there is to be a 
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threat assessment issued, it would be done through DHS I&A? 

A No. No. And, actually, it's really, | mean -- and are you talking about 
more along the lines of, like, a special event threat-assessment-type activity? 

Q Sure. Yeah, like a typical -- a joint intelligence bulletin. I'm just trying -- 

A Yeah. 

Q_ --to kind of understand, as said, what should've happened and what 
needs to be, kind of, institutionalized. Because, as we talked before, a lot of this is so 
personality-based, if you have a good relationship with the SAC of whatever FBI office, 
whatever city you're in. And how do you make it just much more smooth in terms of 
information flow? Which you touched upon, but | just want to get an idea of what the 
fusion centers -- where that information flows to. 

A No, absolutely. And so that tip or lead or threat that may come through to 
a fusion center that is doing the triage, that information normally goes directly to the 
Joint Terrorism Task Force or through that eGuardian process. So -- 

Q_ Right. 

A So they're the ones that get that data. That information does not go 
directly to DHS I&A or any DHS component. So they're unfortunately not in the loop on 
that, necessarily. And so -- 

Q Well, it does go, but to the eGuardian system that heads to the Bureau, 
correct? 

A Yes, that's correct. But that's only for those threats that meet the 
thresholds of the eGuardian system. That means there's a whole lot of other threats 
that are not there across the country. 

So that means those threats are being held at the local level without national 


visibility. And that's one of the problems. Although eGuardian has expanded to have a 
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cyber component, a counterintelligence component, and a terrorism component within 
the eGuardian platform, the majority of those threats are still being held at the local level. 

That was kind of -- unfortunately, when we moved from the shared space 
environment where there were servers in a number of fusion centers across the country, 
we lost that interconnectivity nationwide. 

Q It just highlights so many different gaps there are to not synthesize the 
information. 

A Yes. 

Q So what's your reaction to, you know, the number of press reportings that 
there were so many warnings in plain sight, everybody knew this was coming? But it 
seems that, from what you're saying and, you know, talking to many people, that the 
information gets siloed. And then it's these certain guardrails and threshold 
requirements within agencies that prevent forward-leaning threat assessments, as you 
said. 

Is that fair? 

A __ That's fair. 

And | was going to add that, you know, one of the issues that has come up -- we, 
actually, on the Criminal Intelligence Coordinating Council have been working ona 
nationwide promising practices on tips, leads, and threat-to-life reporting and how to 
process them. 

During the discussions, we found out from the National Threat Operations Center, 
you know, once they became the NTOC -- it used to be the public access line for the FBI, 
but, you know, they started getting in the process of, you know, receiving calls from 
around the country, from the FBI's perspective, thousands of calls a day from throughout 


the country. And those tips and leads are, you know, currently being held ina siloed 
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database that none of us have access to. 

So we're in conversation with the FBI about: We need those tips and leads, we 
need that information. Because, that way, we can -- you know, if we've got specific data 
that we can match in there to a local jurisdiction, that local jurisdiction needs that 
information. 

Q Uh-huh. 

A And so that's one of the many issues we've got, as you said. We've got all 
these silos of excellence around the country that aren't cross-pollinating the information 
and allowing people to do cross-analysis. 

And that is one of the -- the other major problem is, we really don't have a 
nationwide intelligence management system. You know, there has been work that's 
been done through our RISS partners, the Regional Information Sharing Systems, to 
interconnect RISS intel to other intel databases. And that has been supported through 
the Office of the Director of National Intelligence to make that happen, but it's not 
happening across the country. 

So there's, like, these great projects that just don't have enough money that 
should've been implemented a long time ago to interconnect individual criminal 
intelligence databases around the country so they could share information that individual 
units are seeing. And that's not where we're at. 

And then we currently have -- | have fusion centers that don't have a system. | 
mean, they may have, you know, a database that they're using, but they don't have 
analytical tools to the level that they need, because they can't afford it, because they're 
so small in size or their State doesn't have enough, you know, Homeland Security grant 
funding or there's not enough general funds. They're just operating the best that they 


can. Andso having the capacity to share that information effectively is critical. 
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The other thing is that cross-jurisdictional sharing -- and that's been the problem 
with tips and leads, is that some of these things that we receive don't meet Federal 
thresholds. They may meet our local prerogative, but we don't have the ability to share 
that. 

The other component is dealing with juvenile information, because some of these 
threats that we receive are coming from kids. And how do we manage that data? 

So we've got a number of silos of data and information that, in my mind, could 
prevent the next attack, but we're not sharing it. 

Q Uh-huh. 

Before | turn it over toll, | just have one question about DHS I&A. Couldn't 
they require the fusion centers to -- or, couldn't DHS |&A be required to engage with the 
fusion centers with their information? Because it sounded like that still is an ad hoc 
situation and not institutionalized. 

A Now, when you say required to share information, is that Federal or DHS I&A 
reporting? Or -- 

Q Just in terms of receiving the information, it didn't -- and correct me if I'm 
wrong -- it doesn't sound like they have or are receiving all of the -- or they are receiving 
all the information the national fusion centers pushed out to them, or is it just based 


upon whoever is leading a certain fusion center? | guess that's the question. 
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[12:58 p.m.] 

Mr. Sena. Oftentimes, unfortunately, the connection is based on fusion -- |I&A 
personnel being deployed to fusion centers. | -- just yesterday, | had a DHS I|&A, you 
know, intel officer, you know, run up to my office and go: Hey, I've got this threat to 
one of the local police departments, and it came over, you know, from a -- a, you know, 
foreign source, and this is X, Y, Z. 

If | didn't have that guy in my office, | would have not known that that information 
existed. So that's the issue right now, is just based on people being in the office, having 
access to systems and all the information. And, without that, then you're in the blind. 

So | think that's the problem that we have, is that, without having those people, 
you know, in there every day, things get lost. And, you know, kind of the reason that 
these things need to be institutionalized so, that way, there is a requirement that you 
have, you know, this many personnel, this type -- and | would say even this type of 
personnel, and I'll even say this type of role, because | -- in my own experience, | have 
seen fusion centers and their relationship with one of the organizations change 
tremendously based on the personality of the person that shows up to work there. 

Q Uh-huh. 

A | see people that have said: |aminthis fusion center. I'ma part of it. 

| even had one FBI person that sent a note to all of his colleagues in the FBI saying: 
Hey, I'm working this center. Send my emails to this fusion center address. | won't 
answer my FBI address. 

Now, that didn't make them too happy, but it showed their commitment and their 
engagement, while I've had others that show up and go: I'mjustaliaisonhere. I'm 


going to hangout, and, you know, I'm not here to work too hard. | mean, they didn't 
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actually say that, but that was kind of the attitude that was put out there. 

And, without that full engagement, without that, you know, top -- you know, from 
the top saying that "we are -- this is our fusion center, we are a part of it, and we are 
supporting it with everything that we can," we're going to continue to see gaps in 
engagement and capability if we don't have that commitment from leadership. 

And that, | think, is probably our biggest issue as far as the exchange of 
information because the technology to exchange it doesn't exist right now. | mean, it 
exists, but it just has not been deployed to the level it needs to be deployed to do true 
integration. 

There is another problem with DHS I&A as far as, you know, their designation as 
the -- you know, that access to criminal justice information. Soa lot of my realm is in 
the criminal justice information sharing and intelligence. 

So, without them, you know -- you know, having that authority to access 
information, we're always struggling -- and | have had this happen time and time again 
where folks are saying: Well, | can't really give this to, you know, DHS |&A because it's 
criminal -- it's got criminal justice information and, you know -- and | have agencies that 
will refuse to share the information with anyone that isn't a designated law enforcement 
agency. 

Q_ That -- that's super helpful. 


a | don't know if you want to take a minute before [J starts, if 


you want to take a few minutes’ break, or is going to jump in. 


i are you -- there he is. 
———— Hi. Actually, | had my -- do you need to take a break? It's 


a -- please, if you need to take a break. 


Mr. Sena. Oh, totally up to you guys. You know, | can run through, but, if folks 
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need to take a break -- I'm sure folks have taken a break if they don't have their camera 
on, but -- 

EE Okay. If you're okay with running through and, ia. if 
you're okay with continuing, I'll start asking some questions, and I'll try to be respectful of 
your time, Mike, and of everybody else's time, leaving some time for my team -- my 
other -- my teammates on the select committee to kind of ask final questions and such. 

Both andi have done a really good job asking a bunch of questions 
that have addressed some of the stuff | was going to ask you, Mike, so I'm sorry if there is 
some repetition here, and you can just, you know, point that out, and we can move on. 

But, with that in mind, I'd like to ask a couple of specific questions that | think 
build off of stuff that we have been talking about in the last 25, 30 minutes, all right? 

The first is awfully specific, and it relates to, for lack of a better term, joint special 
event threat assessments, right? So that is -- you know, what I'm trying to describe 
there is interagency threat assessments that address particular events, special events, 
you know, public activities of concern, right? Not intelligence assessments looking at 
sort of, you know, threats like, you know, particularly terrorist organization, but threat 
assessments or special event assessments that look at the security picture surrounding 
events, right? 

So is there a methodology for these in the Federal Government -- a broad 
methodology for -- a broad methodology for how to approach that, how to do that? 

A Well, there is -- | wouldn't say a broad methodology, but there are practices 
that we have used, doing joint threat assessments, and FBI and DHS have been doing 
them for quite awhile. | can tell you, it's gone up and down. __| mean, | can tell you 
that, you know, there have been a number of issues between the agencies on their joint 


threat assessments and especially if they're doing a joint bulletin, a JIB, and some cases 
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where one agency would say: Hey, | don't feel comfortable with sharing this JIB with 
you, but give me your logo because | feel that you'll send it out before | do, or, you know, 
little issues like that that have come up before. 

But | do think that, you know, that there are protocols between those two 
agencies. |'d say that the less certain protocol and the one that needs to actually be 
included more often is that joint, you know, threat assessment, or JIB, capability, 
especially with the local impact of the fusion center, whatever fusion center that may be, 
to make sure that you're getting the State and local perspectives in those threat 
assessments. 

So, oftentimes, you know, | will get reporting: All right, we're going to push out a 
joint intelligence bulletin, or we're doing this joint special event threat assessment. 

And my question is always: So who is the local or State and local perspective 
that you've included in that? 

And, more often than not, there isn't any. 

And | think that's one of the key missing components of that, is that that should 
always be included. You've got to get the State and local perspective for those threat 
assessments. 

The other one is the coordination between FBI, DHS analysts and fusion center 
analysts working together on those assessments. You know, not to, you know, the last 
minute getting together and going: Okay. Readthis. You know, years ago -- a couple 
years ago, DHS I&A started, you know -- we had had this discussion about, you know, 
having these, you know, kind of mission centers and later called mission cells -- it went 
back and forth -- but on specific topic areas, whether it be cyber, terrorism, you know, 
criminal activity of -- general criminal activity, you know, transnational organized crime 


groups. 
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And, you know, during the development of that, you know, | asked DHS I&A, | said: 
Hey, who are the local folks that you're going to have in these mission centers? 

And they go: Well, we're going to build them out, and then we'll bring in the 
locals. 

And my perspective is always that you should always bring in all the partners to 
start off with and not try to build something or put something together and then, as an 
afterthought, say: All right, yeah, let's get the guy down the street to come in, 
and -- now that we have everything set up. They need to be part of the structure and 
building. 

Q Thanks. Thanks, Mike. 


You're welcome. 


> 


QI think | might have garbled the question a little bit, and | apologize for that. 

A That's all right. 

Q = Sol'm not so much interested in the JIBs, because those can be used fora 
variety of purposes, you know, tracking, you know, a particular threat, particular terrorist 
organization, a particular emerging issue, right? 

A Yeah. 

Q What I'm really kind of focused on is, is there an approach, a methodology, 
for understanding the operational environment surrounding a special event, right? So 
developing a product for a special event, aside from the ones that are, you know, 
established for the NSSE and, you know, if you could talk about that a little bit. 

A No, no. Absolutely. | mean, for those larger events, there is a 
standardized, you know, format that has been used over and over again for joint special 
event threat assessment capabilities. But, oftentimes, that's sometimes missing. _ If it's 


not a major national event, you know, people may or may not even have a conversation 
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about doing a joint special event threat assessment, whether it's worth the time and 
effort and trying to put together a product, whether you've got the resources and 
bandwidth to do a specific product on a threat. 

And, of course, the unfortunate thing is that we've seen many joint special event 
threat assessments that are, you know, 12 pages long, and the bottom line is, oh, we 
don't see any threat. 

And so, you know, there is kind of a hesitancy on some levels that, unless it's a 
major event, should one even be done? And -- but, when you have a lack of any special 
event threat assessment or coordination, even if it's a one-pager saying there is no known 
threats, but keep a lookout for this, | think that's worthwhile. _ | do. 

But, you know, but oftentimes people are afraid of looking at these products that 
are done for a national security event -- a national special security event that people are 
hesitant to do joint threat assessments and bring the people together. 

But | do believe that, if you bring the people together, and even if they decide 
we're not going to do a full-blown, you know, joint SETA, joint special event threat 
assessment, that we're going to send out a document, and we actually -- | started doing 
this myself. We started -- and, actually, | shouldn't say we -- that we started doing them 
for myself. 

| had a DHS I&A intelligence officer who was amazing i And 

BR ou know, came forward, and he said: Hey, we're getting special event threat 
assessments for everything under the sun. And he goes: Wecan't do all these threat 
assessments. And he goes, but what we can do is we can look up if we have any known 
suspicious activity reporting associated with an event or events like that. Wecan look at 
past events that have happened based on this type of event that's occurring, and we can 


give them our standing concerns of these are the things that you should take into 
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consideration and the information that you should collect and send us if you see it. 

So -- and of course, in Bl fashion, he called it SCAMPE. | -- you know, it's -- it 
sounds like a food item, but it's Standing Concerns at Major Public Events. And that 
document is something that, when anybody asks for an assessment of their event, we 
have FBI personnel in the office, our DHS personnel, and all of our State and local 
personnel there who are working on these SCAMPE assessments and can get that out to 
people when we don't want to do a major, you know, joint SETA. 

So there is at least something that somebody gets to say: This is what you 
should be looking for; this is what's happened in the past; and this is what you should be 
prepared for. And | think that's better than giving people nothing. 

Q  Soisthe SCAMPE product a formal product, or is it something that is -- it is a 
formal product? 

A It's aformal product. So it has specific, you know, categories of 
information that the analysts need to put together, and collect and review, and then 
produce. And so, you know Jil was phenomenal before he left DHS I&A. He's still 
phenomenal. He's a leader for security in our Jewish community in our area. 

But he is -- he and who is -- actually, who is now 
with -- working on the regulatory side -- on the nuclear regulatory side, was an FBI 
supervising intelligence analyst, and they were a dynamic duo that created many of the 
products that are still standing products in my center. But it was a DHS lead and FBI 
lead working with a State and local lead that developed a great foundation that, you 
know -- that doesn't exist in a lot of other places. 

So | do think that doing something at least at the minimal level of that gets people 
attuned to the potential threats and potential activities that they should be doing prior to 


an event. 
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Q_ And, just a simple followup on that, because I'm not sure I'm clear, the 
SCAMPE product is just in your fusion center, or it's DHSwide? 

A It is not DHSwide. Other centers have adopted the SCAMPE model and 
some of the other things that we've developed at the Northern California Regional 
Intelligence Center, but itis not. And, you know, | wish it were. | wish that -- you 
know, that that was, you know, something that was more greatly adopted. But there 
are. you know, a number of product lines that, you know, could be used nationwide 
that should be, you know, more standardized. 

Obviously, each community has a different need. Each fusion center, each field 
division has a different need for what they're producing. But, you know, there should 
be at least some level of capability that provides those types of products. 

Q_ Thank you. 

So, given your background, you are a longtime consumer of Federal intelligence, 
of State and local intelligence, products -- formal intelligence products, finished products, 
right, as well as law reporting. 

A Yes. 

Q How would you characterize FBI and DHS domestic terrorism intelligence 
compared to other sorts of intelligence, its value, its worth, its -- 

A You know, | mean, | think that the products have actually gotten better over 
the years. | think that there have -- obviously, | think there has been some hesitancy a 
number of years ago to do domestic-type products, at least within I&A. You know, there 
is -- mainly because of the U.S. persons issues from their perspective. 

But | do think that, you know, oftentimes the products are so vague that they 
really don't give enough information to the user to take action, and | think that's probably 


our biggest issue, is that -- you know, they make it in such a way -- and because -- you 
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know, and | have told this to the FBI and DHS repeatedly, is that the media is going to get 
the information we've got no matter what. But, if we don't give it to the people that can 
take action on it, we're failing. 

And, continually, we get products that are -- don't provide the overview that a 
local chief of police needs, a local sheriff needs to direct resources within their 
organization agency. 

And | think that's problematic, is that -- you know, that -- you know, and the other 
part is, as | was mentioning earlier, is that, you know, the bottom line is not always 
upfront, and as chief executive, if he reads the first two paragraphs in something, I'd be 
amazed most of the time just because of time constraints and how busy they are. 

So, if you don't catch their attention immediately, | mean, even over the last few 
years, | have had chiefs who have called me and told me: Why is blank agency sending 
this out? | do not have the time to read, you know, 4 pages to get to their point, and all 
the caveats. 

And | think that's the problem. And we have told actually our intel summit that 
we had with our -- many of our major law enforcement association members and the FBI 
this last year, that was one of the first things that came up. And think it broke the 
hearts of the analysts that were hearing this, but they said: Hey, we don't have time to 
read, you know, your 10-page analytical product that, you know, looks like your master's 
thesis. Why don't you tell us what the hell we need to do, and that's the bottom line. 

And | think that that is something that at least our Federal partners need to adapt 
their products, because they're not writing it for the intelligence community. They're 
writing it for people on the ground who are going to be able to take action. 

Q Tome, it sounds like -- and please correct me if I'm wrong -- that you are 


suggesting that they're not -- these products are not especially anticipatory, and they 
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don't provide valuable information that can be operationalized or useful in a clear 
fashion. 

A I'd say that's correct. 

Q Okay. Onthe issue of operationalizing intelligence, you've talked a lot 
about the ISE and its evolution, the information-sharing environment and the program 
manager for that environment. | believe that that environment was created to handle 
terrorism -- counterterrorism information, essentially as an intake for that information to 
develop very specific FBI investigations as the lead investigative agency, right? So it's 
like this intake system to produce FBI cases. 

If that's the only way to effectively operationalize intelligence, what are we 
missing? 

A Well -- and | -- and going back to that part of the information-sharing 
environment -- and, truly, it was. It was that counterterrorism, international terrorism 
focus of the PM-ISE, and the problem that | find in -- especially in operationalizing 
intelligence is that the threats that we see, even -- whether it be international or 
domestic terrorism, the indicators and the activities oftentimes aren't popping up as, you 
know, bright red flags for, oh, this is a terrorist group, or this is a terrorist organization. 

| mean, | can't tell you the number of times I've done investigations and led 
investigations and managed investigations where it's been somebody involved in some 
type of other innocuous criminal activity where that has led us to a terrorist cell ora 
terrorist group or terrorist fundraising, where, you know, | think that, because the focus 
has been so narrow on especially IT for such a long period of time, that it led us to be 
extremely blind on some of our DT issues, and not only our DT issues, but other, you 
know, criminal activity and issues that, you know, resources should be allowed to be, you 


know, focused on, because, if all we're doing, like the Maytag repairman is waiting for the 
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guy to show up with a backpack bomb, we're going to miss the guy with the big Ryder 
truck that's driving right into the building. 

And we need to have that ability to, you know, be flexible nationwide in what 
we're looking for, truly focused on that criminal intelligence perspective and the 
functional standards within the information-sharing environment versus suspicious 
activity reporting that we are looking at the threat perspective holistically, not waiting for 
the backpack bomber. 

We've got to be able to identify those threats in advance. And the only way to 
do that is to develop a tripwire collection network across the country of liaison officers. 
And we have some areas of the country that have fantastic, phenomenal liaison officer 
programs. And it's not just police officers. It's all parts of the community that can 
know and learn what these threats are. 

The other thing is we've got to focus our resources and efforts that the collection 
methodology needs to be consistent across the country. There is only one State in the 
country that tells their fusion center they can't collect SARs. They collect tips and leads, 
but they can't collect SAR reporting. That's Montana. As far as | know, everyone else 
can collect the information and triage it. 

But, you know, there is a lot of misdirection on where this information should go. 
| mean, even with the physical SARs, it's a -- in our unified message, contact FBI or JTTF, 
and somehow they'll get the information together. Well, that's a little confusing, and 
especially depending on which gets it. There needs to be more consistency on -- and it 
may be region to region, but there needs to be one agency that collects all the 
information and triages the information. 

The other component of that is, on the cyber threat SAR, oh, it's even worse. 


They tell you five different places to go and that somehow they're going to share 
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information with each other. 

So we've got to have more of a unified capability in both the planning piece for 
what we're going to collect, the collection methodologies and the way we train our 
partners across the country to identify threats and then push that. 

And that's both for our public employees, our government employees, as well as 
our partners like in the social media companies. You know, there is no training class 
that's provided to social media companies on how to triage threats and how to get those 
threats to the government effectively. 

So, without that -- and they're -- you know, unfortunately, that is a large part of 
our world right now, is social media. That's our insight into many things these days. 
And, without that capability, without that training, and without, you know, them 
understanding the process, which is confusing to even the government folks, that's how 
the things get missed. 

Q Just as a note, it seems like you're describing two continuums or two sets of 
relationships, | guess. But | think your concerns seemed to focus, one, on figuring out 
how to make things less personalized in terms of relationships and far more institutional. 
So that's one dynamic. 

And then there is the kind of federalism dynamic. How do you take a 
decentralized system and include, at very specific points, centralized elements that help 
coordinate and help with collaboration? 

And, toward that end, you've laid out the -- you've thrown out the idea of the 
HIDTAs. You've worked inaHIDTA. YourunaHIDTA. I'msorry. And HIDTAs, | 
believe, are funded by the Office of National Drug Control Policy? 

A __ That's correct. 


Q___Is there -- were you suggesting earlier that, for information sharing broadly 
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or for DT or for some notion of threat here, aside from drugs, that there should be an 
equivalent of ONDCP in managing grants, managing information, managing budgets, 
engaging in some sort of executive review of what goes on in the program writ large? 

A Absolutely. | mean, | have worked in a HIDTA program since 1997, and that 
was the first time that | became part of a HIDTA task force. And | have seen how that 
program has, you know, developed and been inclusive. 

It's had -- you know, through the Office of National Drug Control Policy, the 
Director of ONDCP has a Nation -- a National HIDTA Director, person whose role it is to 
coordinate with all of the HIDTA directors. 

And, you know, we also have a performance management program, and that's 
probably one of the biggest pieces of what we do, is that we can -- we have developed 
metrics of success in how we operate and coordinate. 

We also have a mandate within the HIDTA program that it must be Federal, State, 
local, and Tribal, and territorial partners co-located, commingled, and working together. 
That model has, you know, led to the largest full-time task force program in our country, 
you know, almost 20,000 task force officers that are full time working on this effort and 
doing amazing work every day. 

Roles and responsibilities are clearly defined with a program policy and budget 
guidance, so that way we know what we can do, what we can't do, what we can spend 
money on, what we can't spend money on. = And they leave a lot of discretion to the 
HIDTA directors in the coordination and evolution of this. 

The other part of it is that every HIDTA has a -- has to have an executive board. 
We can't spend a dime without an executive board that is balanced. Half of the 
executive board has to be Federal executives. Half of the board has to be State, local, 


Tribal, territorial executives. So, automatically, we get the buy-in from an executive 
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board that is made up from the region that you operate in. 

We also have the ability to -- if we have an issue or there is a grant question or a 
funding question of, can we use money on this or that, we have people that we can 
directly reach out to and solve the problem that day. 

| have been unable to solve most of my problems in grants on the homeland 
security side in a day, let alone a week, a year -- years, things have been unsolved. And 
having an office like that that helps facilitate, coordinate, | can't tell you how well it has 
worked out compared to the disarray that | currently work in with, you know, the 
hodgepodge of how things may or may not work. 

There is standardization. | mean, each HIDTA has its ability to be flexible to its 
environment to support the issues of the drug threats in their area. Now, true fusion 
centers have a much wider scope of threats and things that they're coordinating and 
working on, but it is, from location to location, so very different on how they operate, 
whether they have the Governor's support, or whether they just work for the State 
police, or the local sheriff, or the chief of police, you know, how their funding model is, 
and how they work and operate. 

And even the funding itself, you know, we have no clarity. | mean, it was a 
struggle. And Congress asked many times, well, how much money is going to fusion 
centers? And, hell, FEMA couldn't figure it out. And those are the things -- and the 
problems that we have is that, you know, we really don't know -- | mean, we have a 
number that is provided that they do in their reports that says this is the amount that 
goes to fusion centers, but it is so off the charts wild in where and how it goes that, 
without some type of organization that brings people together -- and it's worked out well. 
| know that it's been up and down the White House, ONDCP, and there have been some 
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agency. But I'll tell you, we have told Congress repeatedly that, if they move the 
program out of the White House and into a specific Federal agency, we immediately 


alienate the other agencies -- 


Q  And-- 

A -- and lose participation. 
Q_ Sosorry. 

A No problem. 


Q That's an interesting point, because it, to me -- as an outside observer, it 
seems that FBI owns the domestic terrorism, the counterterrorism landscape, and is that 
one of the challenges that you face, is that the -- that FBI and DOJ claim ownership in this 
space and play an oversized role? 

A | wouldn't say necessarily that it's that they've taken an oversized role. | 
mean, it's a really interesting dynamic between DHS andthe FBI. Although, you know, 
FBI has that primary, you know, programmatic responsibility for the investigation, the odd 
thing is that, you know, the DHS still has the responsibility for the Nationwide Suspicious 
Activity Reporting Initiative part and the policy training, the outreach, the coordination 
effort. 

So it's a really weird dynamic. You know, FBI has the technology; the data is in 
there, and DHS is oftentimes pulling teeth. 

But it is problematic, especially depending on which field office someone is in. 
Either, you know, you've got the greatest symbiotic relationship between the fusion 
center and the FBI possible, or you've got it where they're aliens from other universes and 
dimensions where they don't even really know each other. 

So it's really hard to say, all right -- and there has been discussions and even 


when -- you know, even discussions over the last few years about, well, if FBI, you know, 
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took over the leadership on the fusion center program, the coordination, of what would 
that mean? 

And | have to be honest. Nota lot of people in our world thought that would be 
a great idea, mainly because a number of things is that, you know, if the FBI took over the 
programs, we'd have the same blind spots that the FBI has of, you know, working within 
their environment that would really decrease our capacity of what we do as independent 
organizations. 

The other component of that was that, you know, depending on the leadership 
within the organization of -- within the FBI, what priority and resources they would 
provide to a fusion center, and then the whole point of we have 3,000 people that are 
working in fusion centers today. The FBI can't build enough space to fit 3,000 more 
people anywhere. So that -- there is a whole lot of logistics that have stymied that type 
of conversation with the FBI. 

Q  So--thank you. 

A far narrower question, and it builds off of some of the questioning, | 
think -- some of the questions that BM asked around Dr. Harvin and the teleconference 
that you had. This is a very basic question. How unusual was that teleconference? 
Was it something that happens every year, like a similar kind of thing happens every year, 
twice a year, 10 to -- how unusual is it? 

A At the time, it was fairly unusual. | mean, we -- and, you know, | was -- you 
know, after we had that conversation, | actually was, you know -- | felt a little bad, 
because | felt it was a little late in the game to have the call, but | felt a little better than | 
do normally because | said: At least the threat isn't upon us and we're not having the 
emergency call to stay that we're inundated with whatever the mass-casualty attack is of 
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So |, you know -- and especially getting that many people on the call -- | mean, we 
oftentimes will get 140, 150 people from the network that will hop on a call for a major 
national call. And, since then, we've had other calls when people have asked -- when 
they said: Hey, we think we've got something that is a major public safety concern. 
And, since we've had that call, we are actually having a lot more people join these types 
of calls now. 

But it was fairly unusual to have a pre-event call at that level, of that many people 
joining, to prepare for, you know, just collection of information. 

Q Can you speak to -- a little bit about the DNI Dom program, its shortcomings, 
potential strengths, things that you think you'd like to change, maybe describe the 
program a little bit, and then launch into your critiques of it. 

A So the -- the Domestic DNI Partners Program is really designed around 12 FBI 
field divisions where the FBI special agent in charge or assistant director in charge is a 
representative for the Director of National Intelligence in the area and with the goal being 
to bring together the intelligence community components in that region to discuss, 
address threats, communicate the major issues, and, in some cases, develop products 
based on those identified threats. 

And -- but, from the downside of it -- I'll start off with the good side. At least it 
brings together the components from the intelligence community that would not 
otherwise get together unless there was some type of threat issue. So it at least gets 
people a muscle memory to come together and know who their partners are, which 
oftentimes may not happen. | mean, depending on if -- you know, who you have in your 
local area or, you know, your IC community, your intelligence community members that 
are ina local part of the country. 


And each one of them have, you know, got different authorities, especially with 
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how they collect information or share information or develop products. But, you know, 
it has at least brought the folks together. 

The downside is -- is that many of the DNI rep meetings do not include the State 
and local perspective. So it's really just the IC. So, you know, we may have areas of 
the country where, you know, the fusion center representatives in those areas may not 
even know there is aDom DNI program. Many of them don't. 

And so their perspectives are not heard and not brought into the conversation. 
And a great example I'll give you -- and this was actually -- and | can't get into too many of 
the details, because they're at a classified level, but the Dom DNI meeting, which is 
actually facilitated by DNI personnel, their partner engagement personnel, that we held 
three of them nationwide, and the three meetings were about the opioid issue and the 
fentanyl threat issue. 

And so we brought in partners -- and this was part of my effort, was outreach on, 
because it was fentanyl issues. | outreached to the other, you know, Dom DNI rep 
areas, and, you know, brought in the HIDTA directors in those areas. 

| also brought in the -- our Nationwide Domestic Highway Enforcement Initiative 
Coordinator. And, during the meeting, we had, you know, great briefings from many of 
the intelligence community agencies on the fentanyl threat. 

The one person that had the most information in the room was our Nationwide 
Domestic Highway Enforcement Coordinator. He had more detailed information about 
the threat and how its impact was. It was amazing to see every analyst in the room shut 
up and taking notes during his entire session, and then having a flurry of questions for 
him. He had the -- he had everything that they were lacking. 

And | think the problem is, although that was a -- you know, an initial effort to 


bring in, you know, someone with a State and local perspective, that's the piece that's 
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missing, because that integration with a State and local -- especially intelligence 
information sharing, collection capabilities, and dissemination capabilities, has to be in 
the room, and that's not normally part of the program. 

So | think that that's something that would need to be expanded. The other one 
is the focus on actual production, of figuring out how to develop products. And here is 
the other problem, is, if we're developing products at the classified level that is not going 
to be shared beyond those folks that have a TS/SCI, we're shooting ourselves in the foot. 

So, although there is plenty of laws about bringing terror lines of products for 
people, | see very few times where there is actual implementation and that we get terror 
lines that can be put out to the broadest audience. And | know that's a struggle, 
because, you know, | mean, you may have a great TS/SCI product, but, by the time you 
get to the terror line, there is bad guys out there doing bad things. | mean, that -- that's 
what it comes to, and we need more than that. 

Q You don't remember the DNI Dom program ever addressing domestic 
terrorism, do you? 

A Ah. | mean, historically, | donot. I've seen it address all kinds of other 
intelligence community gaps, but not off the top of my head. | can't think of anything. 
And one of the, you know, issues that we have with -- especially within the DNI, and 
especially with what was the PM-ISE, was the focus on international terrorism. 

So, | mean, as an aside, we would always, you know, have the conversations that, 
well, whatever we design for international terrorism should be able to be translated to 
domestic terrorism, but not specifically that | can recall, you know, previously about 
DT-focused efforts. 

Q [think I've heard you talk in the past about amending the 2013 National 
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Could you talk to that a little bit? 

A Absolutely. | mean, our 2013 plan, you know, covered a lot of wide 
breadth of areas. It'salarge plan. | really think that we need to update a more 
focused version of it, and even if it's an abridged version of the plan, so that way, it can 
be more easily adopted. 

| think that, you know, it's a lengthy plan, but the problem is, with any lengthy 
plan is that it's hard for people to implement, and | think that, you know, giving people 
that checklist-focused capability of how criminal intelligence should work in their 
organization, both as a consumer and people that are potential contributors of the 
information to develop criminal intelligence, that, | think, is lacking across the country, 
especially with the 18,000 agencies. We have many agencies that don't have criminal 
intelligence capability as far as, you know, product development. 

But every agency should be able to contribute the information to help analysts 
develop products. Sol do believe that the plan needs to be updated. Obviously, we 
need resources to update the plan, and we need, you know, we need the right people to 
bring it together. 

And, you know, from the perspective of the Federal agency partners, | mean, 
they're -- they've always been engaged in supporting these efforts, but, you know, over 
the last, you know, several years, | should say, the funds and resources towards these 
efforts have gone down. And that's because, unfortunately, you know, we're like people 
with our hats in our hands going to agencies and going: Would you please give mea 
little bit of -- you know, a couple of dimes so | can -- | can make a phone call? 

No, | know it costs more than a couple dimes now to make a phone call, but, you 
know, it's that -- you know, going out there and trying to go to agencies to get 


contributions is hard. And, depending on, you know, who is leading an agency, it's 
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sometimes like pulling teeth to get the funding to do projects and to get the bandwidth to 
do those projects. And, to doit, we've got to have resources. 

And oftentimes it's contract resources to support the effort, but | can tell you -- | 
mean, even products over the last, you know, 3, 4 years, we have -- it has taken us so 
long, because we haven't had the resources to get the products, the people together, and 
especially during COVID, we've had very -- a huge slowdown on production of documents. 
But, yeah, the National Criminal Intelligence Sharing Plan is a big, you know, document 
that we need to figure out how to operationalize this so that it's easier for, you know, 
people in the field to use it. 

Q Inthe past -- | think I've heard you say in the past that there is no formal 
requirement for State, local, Tribal, and territorial partners to share DT information, 
counterterrorism information, let alone domestic terrorism information. 

Could you talk to that -- speak about that as a problem, a challenge, how it might 
be overcome? 

A Absolutely, that's correct. | mean, you know, when you look at, you know, 
State, local, Tribal, territorial agencies, | mean, there are requirements that, you know, 
domestic violence, that you report domestic violence. There is requirements that -- you 
know, sexual exploitation of a child. You know, there are all these requirements on 
certain topic areas. 

But, if there is indicators of terrorism or things that, you know, may be suspicious 
activity reporting, there is no requirement that anyone reports anything to anybody. So, 
you know, there is a huge, you know, gap to me, along with the social media companies. 
They're -- | mean, same thing for the social media companies. There is no requirement 
that they share the information that they're seeing on potential threats to anyone. 


Now, true, you know, there is always this civil liability and litigation that people 
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are concerned about for not sharing information. But, without a requirement that 
certain things get reported to a specific group, you know, bad things will happen and do 
happen because someone had a piece of information and just didn't know what to do 
with it. 

Now, some agencies, like years ago, LAPD, started implementing, you know, a SAR 
area on their reporting forms, saying that, okay, so at least it became an indicator. 

More recently, one of the things that we did in my area related to privately made 
firearms, ghost guns, you know, is that -- you know, there no requirement that anyone 
report to anybody, but | -- you know, we -- we created a Western Region Crime 
Intelligence Working Group, and one of our local labs -- the director goes: |'m going to 
put that on my lab form that -- you know, a little area that says: If this is a privately 
made firearm, a ghost gun, did you report this to the fusion center at this location? 

That type of -- you know, that type of, you know, institutionalization is what needs 
to happen. Weneed to have the ability that, if someone is receiving Federal grant 
funds, that they have a requirement that they have a liaison officer and that they 
have -- or liaison person with their fusion center and that that agency reports. 

Going back to the HIDTA program and the High-Intensity Drug-Trafficking Area 
program and how that operates, every HIDTA task force initiative must submit all of their 
investigations into the deconfliction system. They don't have an option. If you don't 
do that, you don't get any money. 

So why are we not holding people accountable, both for a deconfliction when they 
receive Federal funds and for suspicious activity reporting when they receive Federal 
grant funds. | mean, you would think we'd want to protect our country and make sure 
that people are reporting information to the right place, but there is no requirement that 


anybody does that. It's all out of the goodness of their heart. 
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Q | think a version of this -- 


| And this will be my last question [Ae and a. if you have 


final questions. | want to save some time for the two of you or anyone else. 
a 

Q_ | think a version of this question has already been asked, and | think I'm just 
going to simplify it and say: So why did we miss January 6th? 

A A multitude of things. | think it was a lack of that coordinated ability to put 
everything in the same space at the same time so people could see it. You know, even 
within our nationwide situational awareness room that we had through HSIN, oftentimes 
there are FBI personnel in the space but no contributions. Same thing for DHS. 

| think that, you know, without having the unified and joint capability of having 
the right people in the right room at the right time to do those -- you know, do the 
assessment of the threats, to share the information, | think that was one component of 
this. 

| think that, from the executive level, you know, just a lack of folks not getting the 
full picture of what was being seen around the country and, more specifically, you know, 
knowledge that these groups and folks were forming in various locations around the 
Nation to all kind of show up there, | think, you know, our major inabilities to hold each 
other accountable for how we cooperate, | think that really, at the gist of everything and, 
you know, the point of all of this is that communication is the key to stopping any threat. 

As long as people are sharing everything they have, as long as analysts who are 
forward leaning have the information, as long as the officers in the field have the full 
perspective of what the threat may be and have the support to implement security 
measures or deploy resources appropriately, we're going to continue to miss threats. 


And | think that it was that combination of many things, including, you know, fear 
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that somebody was going to overstep or that these were First Amendment protected 
activities and, you know, for some reason, you know, that law enforcement -- you know, 
public safety should not be engaged in First Amendment protected activities. And, 
ultimately, if we are not engaged in First Amendment protected activities, people will not 
be able to express their First Amendment because of safety concerns, of people getting 
hurt. 

So the government has a responsibility to balance the protection of both privacy, 
civil rights, civil liberties, and public safety, and | think we failed in this event because we 
didn't find that balance. And | think there were people who were afraid to go down 
some of the rabbit holes that we were seeing online and say: Well, you know -- and | 
admit, you know, not every person who is online is going to show up and do something 
bad, but there is always going to be a few bad actors. 

And, if we look at this from the perspective of we've got to find the bad actors 
before they implement an attack, because, even in a mob situation, there's agitators. 
There's the folks that will agitate the crowd and lead the mob. | have seen it very 
effective where we have identified the agitators and people that are leading the mob or 
carrying weapons, and we stop them before they get to their location and, in some cases, 
take their weapons away. 

But at least that one point of impact, that one traffic stop where somebody says 
hello to them has deflated their interest in going and doing bad things. And | think we 
can do that in these types of events. 

| do think that, if we don't make drastic changes and do it soon, that we're going 
to repeat January 6th and in a worse fashion, because people now understand the 
vulnerabilities a lot more. Although it may not be as vulnerable at the Capitol anymore, 


there are other locations that people will take advantage of. 


24 


25 


85 


And | think those are the failures. | think that, you know, the need for the 
system to blend and give the authorities to the folks in the fusion centers so they can do 
their jobs, | think that that led to this. The inability to access certain pieces of 
information, that led to this. The inability for people to be accountable for not sharing 
information, those are the things that | think led to this. 

ie | Thank you, Mike. Thanks for all of your time. 


a: | turn it back to you or MM for any final questions, and thank you for 


allowing me to ask questions. 


———— Sorry. l|was mute. Of course. 


Q Well, Mike, we appreciate your time. Is there anything else that you want 
to add or if you think there is someone we should be talking to who could offer further 
insight into these kinds of intelligence gaps and, you know, everything that we've been 
discussing? 

As you're aware, we have been talking to a number of different individuals, and 
we really want to be thoughtful with our recommendations. And you've been a wealth 
of information. So if you have anyone you think might be helpful to us, I'm happy to 
hear that. 

A No. |mean, from my perspective and the folks that, you know, I've been 
working the closest with to try to figure out how to change the way we've been doing 
business, | mean, John Cohen is one of those people. | know -- | know DHS I&A, they 
probably have their -- whoever is going to be designated from DHS, but, | mean, John's 
been working on this tremendously. 

| know Paul Abbate has been critical in, you know, just changing -- the Deputy 


Director of the FBI has been critical in trying to support change in the way we do business 
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and prioritization of the way we do business at the Federal level. 

And then, at the State and local level, you know, there is -- there is a lot of leaders 
out there, you know, whether it's, you know, Don Barnes, the sheriff of Orange County 
California, that is trying to -- to lead, you know, what they're doing from the Major 
County Sheriffs of America, you know -- you know, Mike Milstead, who serves as the 
Global Advisory Committee for the Attorney General, Sheriff Mike Milstead, who is a, you 
know, more of a -- in a rural area of this country, but he's one of those guys that 
represents the sheriffs in those smaller areas of the country. 

And, you know, | always tell people that, you know, whether it's, you know, a 
major city or a small area of the country, we never know where the threat is going to 
come from, and we need to have coverage. That's why the Network of Fusion Centers 
was developed nationwide, is to try to have better coverage. 

Those folks, | think, would be -- give a good perspective from a major metropolitan 
area executive to a more rural executive and the challenges they face with information 
sharing and stopping threats. 

Q_ That's great. AndI know John Cohen was temporarily overseeing I&A 
before he was shifted over to this new position. For both Paul Abbate and John Cohen, 
what changes have you -- what have you seen that you think will be helpful? And then | 
promise this interview is over. 

A No, no worries. 

| mean, | think that their level of bringing -- and a more recent example. The 
synagogue takeover in Texas, you know, immediately, you know, John and Paul started 
working together to put together, you know, just some really great briefings, better than 
I've seen probably in my career, from FBI and DHS and local perspective, trying to get the 
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before. 

| mean, that's, | think, the great thing of the dynamic partnership that those two 
have had and their development is that they've brought a facet to DHS and FBI that | 
haven't seen really before. | have to be honest. | mean, |! would have these 
conversations about -- with leadership in the FBI and leadership in DHS, and they 
wouldn't know who the other person was -- 

Q_ Yeah. 

A -- or they'd know them in passing, but they wouldn't have a true partnership. 

And | think, you know, talking about, how do you institutionalize that so that way, 
you know, the head of -- and Under Secretary in DHS and the Deputy Director of the FBI 
can actually be coworkers and collaborators? 

And so | think that's something that they have brought that really has been 
missing. | mean, you have the conversations between the FBI Director and the Secretary 
of DHS on various issues, but never to the point where I've seen them trying to work 
hand-in-hand. 

Q I'm glad we're ending on a somewhat positive note about things leaning 
forward, but | -- my question is: Do you think that that copartnership that you've just 
described between Mr. Abbate and Mr. Cohen is by virtue of their personalities, or was 
something institutionalized that made this a priority? 

A Personality, | have to say. | mean, it's something that needs to be 
institutionalized. Like many of the things that we currently operate within our 
environment, it's personality-driven. 

Q Got it. 


nel Thank you, Mr. Sena. We really appreciate your time. 


| want to make sure that | say particular language as we endthis. So this 
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transcribed interview stands in recess subject to the call of the chair. So thank you for 
your time. I'm -- we appreciate it, and we'll be in touch. 
Mr. Sena. Thankyou. Thank you all for your time. 
Se Thanks, all. Thanks to the court reporters. 
Mr. Sena. Thank you. 
[Whereupon, at 1:53 p.m., the interview was recessed, subject to the call of the 


Chair.] 
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